@oculum/scanner 1.0.0

package/dist/layer2/auth-antipatterns.js

@@ -0,0 +1,333 @@
+"use strict";
+/**
+ * Layer 2: Authentication Anti-Pattern Detection
+ * Identifies weak or missing authentication/authorization patterns
+ *
+ * Key improvements:
+ * - Respects global middleware protection (caps severity at info)
+ * - Detects throwing auth helpers and suppresses redundant null checks
+ * - Properly classifies public endpoints
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectAuthAntipatterns = detectAuthAntipatterns;
+const middleware_detector_1 = require("../utils/middleware-detector");
+const auth_helper_detector_1 = require("../utils/auth-helper-detector");
+const AUTH_ANTIPATTERNS = [
+    // Missing auth checks
+    {
+        name: 'Unprotected API route',
+        pattern: /export\s+(async\s+)?function\s+(GET|POST|PUT|DELETE|PATCH)\s*\(/gi,
+        severity: 'medium',
+        description: 'API route handler may lack authentication - verify auth is checked',
+        suggestedFix: 'Add authentication middleware or check session at the start of the handler',
+    },
+    {
+        name: 'Express route without auth middleware',
+        pattern: /\.(get|post|put|delete|patch)\s*\(\s*['"][^'"]+['"]\s*,\s*(async\s*)?\(\s*(req|request)/gi,
+        severity: 'medium',
+        description: 'Express route may lack authentication middleware',
+        suggestedFix: 'Add authentication middleware before the route handler',
+    },
+    // Weak authentication patterns
+    {
+        name: 'Hardcoded credentials check',
+        pattern: /if\s*\(\s*(username|user|email)\s*===?\s*['"][^'"]+['"]\s*&&\s*(password|pass|pwd)\s*===?\s*['"][^'"]+['"]/gi,
+        severity: 'critical',
+        description: 'Hardcoded credentials in authentication logic',
+        suggestedFix: 'Use a proper user database with hashed passwords',
+    },
+    {
+        name: 'Password in plain text comparison',
+        pattern: /password\s*===?\s*user\.password|user\.password\s*===?\s*password/gi,
+        severity: 'high',
+        description: 'Plain text password comparison detected',
+        suggestedFix: 'Use bcrypt.compare() or similar for password verification',
+    },
+    {
+        name: 'JWT without verification',
+        pattern: /jwt\.decode\s*\([^)]+\)(?!.*verify)/gi,
+        severity: 'high',
+        description: 'JWT decoded without signature verification',
+        suggestedFix: 'Use jwt.verify() instead of jwt.decode() for authentication',
+    },
+    {
+        name: 'Weak JWT secret',
+        pattern: /jwt\.sign\s*\([^)]+,\s*['"][^'"]{1,20}['"]/gi,
+        severity: 'high',
+        description: 'JWT signed with a short/weak secret',
+        suggestedFix: 'Use a strong, random secret of at least 256 bits from environment variables',
+    },
+    // Session issues
+    {
+        name: 'Session without secure flag',
+        pattern: /session\s*\(\s*\{[^}]*(?!secure\s*:\s*true)[^}]*\}/gi,
+        severity: 'medium',
+        description: 'Session configuration may lack secure flag',
+        suggestedFix: 'Set secure: true for cookies in production',
+    },
+    {
+        name: 'Cookie without httpOnly',
+        pattern: /cookie\s*\(\s*['"][^'"]+['"]\s*,[^)]*(?!httpOnly)[^)]*\)|setCookie\s*\([^)]*(?!httpOnly)/gi,
+        severity: 'medium',
+        description: 'Cookie set without httpOnly flag',
+        suggestedFix: 'Add httpOnly: true to prevent XSS access to cookies',
+    },
+    // Authorization issues
+    // NOTE: We intentionally do NOT flag "if (!user)" or "if (!userId)" patterns as issues
+    // when throwing auth helpers are in use. Those helpers guarantee the user exists.
+    // This pattern is now much more targeted.
+    {
+        name: 'Missing role check for admin operation',
+        pattern: /\b(admin|superuser|moderator|owner)\b.*(?:delete|remove|update|modify|grant|revoke)/gi,
+        severity: 'low',
+        description: 'Potentially privileged operation - verify role/permission checks are in place',
+        suggestedFix: 'Add role-based access control for sensitive operations',
+    },
+    {
+        name: 'Client-side only auth check',
+        pattern: /if\s*\(\s*!?\s*(isAuthenticated|isLoggedIn|user)\s*\)\s*\{?\s*(router\.push|navigate|redirect|window\.location)/gi,
+        severity: 'medium',
+        description: 'Client-side only authentication redirect detected',
+        suggestedFix: 'Implement server-side authentication checks as well',
+    },
+    // Insecure token handling
+    {
+        name: 'Token in URL',
+        pattern: /\?.*token=|&token=|\?.*api_key=|&api_key=/gi,
+        severity: 'high',
+        description: 'Sensitive token passed in URL query parameter',
+        suggestedFix: 'Pass tokens in Authorization header or request body',
+    },
+    {
+        name: 'Token in localStorage',
+        pattern: /localStorage\.(setItem|getItem)\s*\(\s*['"](token|jwt|auth|session|apiKey)/gi,
+        severity: 'medium',
+        description: 'Sensitive token stored in localStorage (XSS vulnerable)',
+        suggestedFix: 'Use httpOnly cookies for token storage',
+    },
+    // OAuth/Social auth issues
+    {
+        name: 'OAuth state parameter missing',
+        pattern: /oauth|authorize\?.*(?!state=)/gi,
+        severity: 'medium',
+        description: 'OAuth flow may lack state parameter for CSRF protection',
+        suggestedFix: 'Include a random state parameter in OAuth requests',
+    },
+    // Password handling issues
+    {
+        name: 'Password logged',
+        pattern: /console\.(log|info|debug|warn|error)\s*\([^)]*password/gi,
+        severity: 'critical',
+        description: 'Password may be logged to console',
+        suggestedFix: 'Never log passwords or sensitive credentials',
+    },
+    {
+        name: 'Password in error message',
+        pattern: /throw\s+new\s+Error\s*\([^)]*password|Error\s*\([^)]*password/gi,
+        severity: 'high',
+        description: 'Password may be included in error message',
+        suggestedFix: 'Never include passwords in error messages',
+    },
+    // Rate limiting
+    {
+        name: 'Login without rate limiting',
+        pattern: /\/(login|signin|auth|authenticate)\s*['"],\s*(async\s*)?\(/gi,
+        severity: 'medium',
+        description: 'Login endpoint may lack rate limiting',
+        suggestedFix: 'Add rate limiting to prevent brute force attacks',
+    },
+    // 2FA bypass
+    {
+        name: 'Potential 2FA bypass',
+        pattern: /skip2fa|bypass2fa|disable2fa|twoFactor\s*[=:]\s*false/gi,
+        severity: 'high',
+        description: 'Two-factor authentication bypass detected',
+        suggestedFix: 'Remove 2FA bypass options in production',
+    },
+];
+// Check if line is a comment
+function isComment(line) {
+    const trimmed = line.trim();
+    return (trimmed.startsWith('//') ||
+        trimmed.startsWith('#') ||
+        trimmed.startsWith('*') ||
+        trimmed.startsWith('/*'));
+}
+// Check if file is likely an auth-related file
+function isAuthRelatedFile(filePath) {
+    const authKeywords = ['auth', 'login', 'session', 'user', 'account', 'credential', 'password', 'token', 'jwt', 'oauth'];
+    const lowerPath = filePath.toLowerCase();
+    return authKeywords.some(keyword => lowerPath.includes(keyword));
+}
+// Check if endpoint is a known public endpoint (health checks, webhooks, cron)
+function isKnownPublicEndpoint(lineContent, filePath) {
+    const PUBLIC_ENDPOINTS = [
+        // Health checks
+        /\/health\b/i,
+        /\/healthz\b/i,
+        /\/ready\b/i,
+        /\/live\b/i,
+        /\/ping\b/i,
+        /\/status\b/i,
+        // Webhooks (receive external calls)
+        /\/webhook\b/i,
+        /\/webhooks\//i,
+        /\/callback\b/i,
+        // Cron/scheduled tasks
+        /\/cron\//i,
+        /\/scheduled\//i,
+        /\/tasks\//i,
+        // Public APIs
+        /\/public\//i,
+        /\bGET\b.*\/api\/\w+\/\[id\]/i, // Public resource reads with ID param
+    ];
+    return PUBLIC_ENDPOINTS.some(pattern => pattern.test(lineContent) || pattern.test(filePath));
+}
+// Check if there are auth indicators in nearby lines (within 15 lines)
+function hasAuthCheckNearby(lines, lineIndex) {
+    const startLine = Math.max(0, lineIndex);
+    const endLine = Math.min(lines.length, lineIndex + 15);
+    const searchWindow = lines.slice(startLine, endLine);
+    const authIndicators = [
+        /authorization/i,
+        /bearer\s+token/i,
+        /req\.user/,
+        /request\.user/,
+        /isAuthenticated/,
+        /requireAuth/,
+        /verifyToken/,
+        /checkPermission/,
+        /getServerSession/,
+        /auth\(\)/,
+        /middleware.*auth/i,
+        /session\s*\.\s*user/,
+        // Internal secret checks (network-level auth)
+        /internal.?secret/i,
+        /INTERNAL_SECRET/,
+        /x-internal-secret/i,
+        /admin.?secret/i,
+        /service.?token/i,
+        // BYOK patterns - user provides their own API key (implicit auth)
+        /userApiKey|user_api_key|clientApiKey/i,
+        /req\.body\.(?:apiKey|api_key|openaiKey|anthropicKey)/i,
+        /headers\[['"`]x-(?:openai|api|anthropic)-key['"`]\]/i,
+    ];
+    return searchWindow.some(line => authIndicators.some(pattern => pattern.test(line)));
+}
+function detectAuthAntipatterns(content, filePath, options = {}) {
+    const { middlewareConfig, authHelpers, fileAuthImports } = options;
+    const vulnerabilities = [];
+    const lines = content.split('\n');
+    const isAuthFile = isAuthRelatedFile(filePath);
+    // Check if this route is protected by global middleware
+    const routePath = (0, middleware_detector_1.getRoutePathFromFile)(filePath);
+    const middlewareProtection = routePath && middlewareConfig
+        ? (0, middleware_detector_1.isRouteProtectedByMiddleware)(routePath, middlewareConfig)
+        : { isProtected: false, reason: '' };
+    // Check if file uses imported auth middleware/helpers
+    const importedAuthProtection = fileAuthImports?.get(filePath);
+    const usesImportedAuth = importedAuthProtection?.usesImportedAuth ?? false;
+    // Check if file uses throwing auth helpers
+    const helpersList = authHelpers?.helpers || [];
+    lines.forEach((line, index) => {
+        // Skip comment lines
+        if (isComment(line))
+            return;
+        for (const pattern of AUTH_ANTIPATTERNS) {
+            const regex = new RegExp(pattern.pattern.source, pattern.pattern.flags);
+            if (regex.test(line)) {
+                // Special handling for unprotected route patterns
+                if (pattern.name === 'Unprotected API route' ||
+                    pattern.name === 'Express route without auth middleware') {
+                    // PRIORITY 0: Check if this is actually a route file
+                    // In Next.js, routes must be in `route.ts/js` files. Files like `handlers.ts`,
+                    // `safe-handlers.ts`, `utils.ts` etc. are NOT actual API routes even if they
+                    // export GET/POST functions.
+                    const isActualRouteFile = /\/(route|page)\.(ts|js|tsx|jsx)$/i.test(filePath) ||
+                        /\/(api|routes?)\/.*\/(index|route)\.(ts|js)$/i.test(filePath) ||
+                        // Express/Koa routes typically have 'routes' or 'router' in path
+                        /\/(routes?|router|controllers?)\.[tj]s$/i.test(filePath);
+                    // Files explicitly named as handlers, helpers, utils are not routes
+                    const isUtilityFile = /(handler|helper|util|mock|test|fixture|safe|example)/i.test(filePath);
+                    if (!isActualRouteFile || isUtilityFile) {
+                        // Not an actual route file - skip this finding
+                        break;
+                    }
+                    // PRIORITY 1: Check if route is protected by global middleware
+                    // This is the STRONGEST signal - if middleware protects the route, suppress entirely
+                    if (middlewareProtection.isProtected) {
+                        // Route is authenticated by middleware - no finding needed
+                        break; // Skip this pattern, route is protected
+                    }
+                    // PRIORITY 1.5: Check if file imports and uses auth middleware
+                    // e.g., import { authMiddleware } from '@/lib/auth' + wraps handlers
+                    if (usesImportedAuth) {
+                        // File imports auth middleware and uses it - no finding needed
+                        break; // Skip this pattern, route is protected via imported auth
+                    }
+                    // PRIORITY 2: Check if file uses throwing auth helpers
+                    // If getCurrentUserId() or similar is called, the route is authenticated
+                    const authHelperCall = (0, auth_helper_detector_1.hasAuthHelperCallBefore)(content, index, helpersList);
+                    if (authHelperCall.hasCall && authHelperCall.helper) {
+                        // Route uses a throwing auth helper - no finding needed
+                        // The auth helper guarantees authenticated context
+                        break; // Skip this pattern, route is protected
+                    }
+                    // PRIORITY 3: Check if this is a known public endpoint
+                    if (isKnownPublicEndpoint(line, filePath)) {
+                        vulnerabilities.push({
+                            id: `auth-antipattern-${filePath}-${index + 1}-${pattern.name}`,
+                            filePath,
+                            lineNumber: index + 1,
+                            lineContent: line.trim(),
+                            severity: 'info',
+                            category: 'missing_auth',
+                            title: pattern.name + ' (public endpoint)',
+                            description: 'This appears to be a public endpoint (health check, webhook, cron, etc.). Verify this is intentionally public and consider rate limiting if needed.',
+                            suggestedFix: 'If this is a webhook or cron endpoint, ensure it has appropriate authentication (API keys, signatures, etc.). Health checks typically do not need auth.',
+                            confidence: 'low',
+                            layer: 2,
+                        });
+                        break; // Only report once per line
+                    }
+                    // PRIORITY 4: Check if auth check exists nearby (inline check)
+                    if (hasAuthCheckNearby(lines, index)) {
+                        vulnerabilities.push({
+                            id: `auth-antipattern-${filePath}-${index + 1}-${pattern.name}`,
+                            filePath,
+                            lineNumber: index + 1,
+                            lineContent: line.trim(),
+                            severity: 'low',
+                            category: 'missing_auth',
+                            title: pattern.name,
+                            description: pattern.description + ' (auth check detected in nearby lines)',
+                            suggestedFix: pattern.suggestedFix,
+                            confidence: 'low',
+                            layer: 2,
+                        });
+                        break; // Only report once per line
+                    }
+                }
+                // Standard handling for all patterns (or fallback for route patterns)
+                // Boost confidence for auth-related files
+                const confidence = isAuthFile ? 'high' : 'medium';
+                vulnerabilities.push({
+                    id: `auth-antipattern-${filePath}-${index + 1}-${pattern.name}`,
+                    filePath,
+                    lineNumber: index + 1,
+                    lineContent: line.trim(),
+                    severity: pattern.severity,
+                    category: 'missing_auth',
+                    title: pattern.name,
+                    description: pattern.description,
+                    suggestedFix: pattern.suggestedFix,
+                    confidence,
+                    layer: 2,
+                });
+                break; // Only report once per line
+            }
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=auth-antipatterns.js.map

package/dist/layer2/auth-antipatterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-antipatterns.js","sourceRoot":"","sources":["../../src/layer2/auth-antipatterns.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AA0PH,wDAuIC;AA7XD,sEAAiG;AAEjG,wEAAiG;AAWjG,MAAM,iBAAiB,GAAsB;IAC3C,sBAAsB;IACtB;QACE,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE,mEAAmE;QAC5E,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,oEAAoE;QACjF,YAAY,EAAE,4EAA4E;KAC3F;IACD;QACE,IAAI,EAAE,uCAAuC;QAC7C,OAAO,EAAE,2FAA2F;QACpG,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,kDAAkD;QAC/D,YAAY,EAAE,wDAAwD;KACvE;IAED,+BAA+B;IAC/B;QACE,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,8GAA8G;QACvH,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,+CAA+C;QAC5D,YAAY,EAAE,kDAAkD;KACjE;IACD;QACE,IAAI,EAAE,mCAAmC;QACzC,OAAO,EAAE,qEAAqE;QAC9E,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,yCAAyC;QACtD,YAAY,EAAE,2DAA2D;KAC1E;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,uCAAuC;QAChD,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,4CAA4C;QACzD,YAAY,EAAE,6DAA6D;KAC5E;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,8CAA8C;QACvD,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,qCAAqC;QAClD,YAAY,EAAE,6EAA6E;KAC5F;IAED,iBAAiB;IACjB;QACE,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,sDAAsD;QAC/D,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,4CAA4C;QACzD,YAAY,EAAE,4CAA4C;KAC3D;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,4FAA4F;QACrG,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,kCAAkC;QAC/C,YAAY,EAAE,qDAAqD;KACpE;IAED,uBAAuB;IACvB,uFAAuF;IACvF,kFAAkF;IAClF,0CAA0C;IAC1C;QACE,IAAI,EAAE,wCAAwC;QAC9C,OAAO,EAAE,uFAAuF;QAChG,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,+EAA+E;QAC5F,YAAY,EAAE,wDAAwD;KACvE;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,mHAAmH;QAC5H,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,mDAAmD;QAChE,YAAY,EAAE,qDAAqD;KACpE;IAED,0BAA0B;IAC1B;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,6CAA6C;QACtD,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,+CAA+C;QAC5D,YAAY,EAAE,qDAAqD;KACpE;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE,8EAA8E;QACvF,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,yDAAyD;QACtE,YAAY,EAAE,wCAAwC;KACvD;IAED,2BAA2B;IAC3B;QACE,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,iCAAiC;QAC1C,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,yDAAyD;QACtE,YAAY,EAAE,oDAAoD;KACnE;IAED,2BAA2B;IAC3B;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,0DAA0D;QACnE,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,mCAAmC;QAChD,YAAY,EAAE,8CAA8C;KAC7D;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,iEAAiE;QAC1E,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,2CAA2C;QACxD,YAAY,EAAE,2CAA2C;KAC1D;IAED,gBAAgB;IAChB;QACE,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,8DAA8D;QACvE,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,uCAAuC;QACpD,YAAY,EAAE,kDAAkD;KACjE;IAED,aAAa;IACb;QACE,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,yDAAyD;QAClE,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,2CAA2C;QACxD,YAAY,EAAE,yCAAyC;KACxD;CACF,CAAA;AAED,6BAA6B;AAC7B,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,OAAO,CACL,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QACxB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACvB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACvB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CACzB,CAAA;AACH,CAAC;AAED,+CAA+C;AAC/C,SAAS,iBAAiB,CAAC,QAAgB;IACzC,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;IACvH,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAA;IACxC,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;AAClE,CAAC;AAED,+EAA+E;AAC/E,SAAS,qBAAqB,CAAC,WAAmB,EAAE,QAAgB;IAClE,MAAM,gBAAgB,GAAG;QACvB,gBAAgB;QAChB,aAAa;QACb,cAAc;QACd,YAAY;QACZ,WAAW;QACX,WAAW;QACX,aAAa;QAEb,oCAAoC;QACpC,cAAc;QACd,eAAe;QACf,eAAe;QAEf,uBAAuB;QACvB,WAAW;QACX,gBAAgB;QAChB,YAAY;QAEZ,cAAc;QACd,aAAa;QACb,8BAA8B,EAAG,sCAAsC;KACxE,CAAA;IAED,OAAO,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CACrC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CACpD,CAAA;AACH,CAAC;AAED,uEAAuE;AACvE,SAAS,kBAAkB,CAAC,KAAe,EAAE,SAAiB;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,GAAG,EAAE,CAAC,CAAA;IACtD,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IAEpD,MAAM,cAAc,GAAG;QACrB,gBAAgB;QAChB,iBAAiB;QACjB,WAAW;QACX,eAAe;QACf,iBAAiB;QACjB,aAAa;QACb,aAAa;QACb,iBAAiB;QACjB,kBAAkB;QAClB,UAAU;QACV,mBAAmB;QACnB,qBAAqB;QACrB,8CAA8C;QAC9C,mBAAmB;QACnB,iBAAiB;QACjB,oBAAoB;QACpB,gBAAgB;QAChB,iBAAiB;QACjB,kEAAkE;QAClE,uCAAuC;QACvC,uDAAuD;QACvD,sDAAsD;KACvD,CAAA;IAED,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9B,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACnD,CAAA;AACH,CAAC;AAQD,SAAgB,sBAAsB,CACpC,OAAe,EACf,QAAgB,EAChB,UAAkC,EAAE;IAEpC,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,OAAO,CAAA;IAClE,MAAM,eAAe,GAAoB,EAAE,CAAA;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IAE9C,wDAAwD;IACxD,MAAM,SAAS,GAAG,IAAA,0CAAoB,EAAC,QAAQ,CAAC,CAAA;IAChD,MAAM,oBAAoB,GAAG,SAAS,IAAI,gBAAgB;QACxD,CAAC,CAAC,IAAA,kDAA4B,EAAC,SAAS,EAAE,gBAAgB,CAAC;QAC3D,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAEtC,sDAAsD;IACtD,MAAM,sBAAsB,GAAG,eAAe,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC7D,MAAM,gBAAgB,GAAG,sBAAsB,EAAE,gBAAgB,IAAI,KAAK,CAAA;IAE1E,2CAA2C;IAC3C,MAAM,WAAW,GAAG,WAAW,EAAE,OAAO,IAAI,EAAE,CAAA;IAE9C,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,qBAAqB;QACrB,IAAI,SAAS,CAAC,IAAI,CAAC;YAAE,OAAM;QAE3B,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YAEvE,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrB,kDAAkD;gBAClD,IAAI,OAAO,CAAC,IAAI,KAAK,uBAAuB;oBACxC,OAAO,CAAC,IAAI,KAAK,uCAAuC,EAAE,CAAC;oBAE7D,qDAAqD;oBACrD,+EAA+E;oBAC/E,6EAA6E;oBAC7E,6BAA6B;oBAC7B,MAAM,iBAAiB,GAAG,mCAAmC,CAAC,IAAI,CAAC,QAAQ,CAAC;wBAC1E,+CAA+C,CAAC,IAAI,CAAC,QAAQ,CAAC;wBAC9D,iEAAiE;wBACjE,0CAA0C,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;oBAE3D,oEAAoE;oBACpE,MAAM,aAAa,GAAG,uDAAuD,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;oBAE5F,IAAI,CAAC,iBAAiB,IAAI,aAAa,EAAE,CAAC;wBACxC,+CAA+C;wBAC/C,MAAK;oBACP,CAAC;oBAED,+DAA+D;oBAC/D,qFAAqF;oBACrF,IAAI,oBAAoB,CAAC,WAAW,EAAE,CAAC;wBACrC,2DAA2D;wBAC3D,MAAK,CAAC,wCAAwC;oBAChD,CAAC;oBAED,+DAA+D;oBAC/D,qEAAqE;oBACrE,IAAI,gBAAgB,EAAE,CAAC;wBACrB,+DAA+D;wBAC/D,MAAK,CAAC,0DAA0D;oBAClE,CAAC;oBAED,uDAAuD;oBACvD,yEAAyE;oBACzE,MAAM,cAAc,GAAG,IAAA,8CAAuB,EAAC,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,CAAA;oBAC3E,IAAI,cAAc,CAAC,OAAO,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;wBACpD,wDAAwD;wBACxD,mDAAmD;wBACnD,MAAK,CAAC,wCAAwC;oBAChD,CAAC;oBAED,uDAAuD;oBACvD,IAAI,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;wBAC1C,eAAe,CAAC,IAAI,CAAC;4BACnB,EAAE,EAAE,oBAAoB,QAAQ,IAAI,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE;4BAC/D,QAAQ;4BACR,UAAU,EAAE,KAAK,GAAG,CAAC;4BACrB,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE;4BACxB,QAAQ,EAAE,MAAM;4BAChB,QAAQ,EAAE,cAAc;4BACxB,KAAK,EAAE,OAAO,CAAC,IAAI,GAAG,oBAAoB;4BAC1C,WAAW,EAAE,qJAAqJ;4BAClK,YAAY,EAAE,yJAAyJ;4BACvK,UAAU,EAAE,KAAK;4BACjB,KAAK,EAAE,CAAC;yBACT,CAAC,CAAA;wBACF,MAAK,CAAC,4BAA4B;oBACpC,CAAC;oBAED,+DAA+D;oBAC/D,IAAI,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;wBACrC,eAAe,CAAC,IAAI,CAAC;4BACnB,EAAE,EAAE,oBAAoB,QAAQ,IAAI,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE;4BAC/D,QAAQ;4BACR,UAAU,EAAE,KAAK,GAAG,CAAC;4BACrB,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE;4BACxB,QAAQ,EAAE,KAAK;4BACf,QAAQ,EAAE,cAAc;4BACxB,KAAK,EAAE,OAAO,CAAC,IAAI;4BACnB,WAAW,EAAE,OAAO,CAAC,WAAW,GAAG,wCAAwC;4BAC3E,YAAY,EAAE,OAAO,CAAC,YAAY;4BAClC,UAAU,EAAE,KAAK;4BACjB,KAAK,EAAE,CAAC;yBACT,CAAC,CAAA;wBACF,MAAK,CAAC,4BAA4B;oBACpC,CAAC;gBACH,CAAC;gBAED,sEAAsE;gBACtE,0CAA0C;gBAC1C,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA;gBAEjD,eAAe,CAAC,IAAI,CAAC;oBACnB,EAAE,EAAE,oBAAoB,QAAQ,IAAI,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE;oBAC/D,QAAQ;oBACR,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE;oBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE,cAAc;oBACxB,KAAK,EAAE,OAAO,CAAC,IAAI;oBACnB,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,YAAY,EAAE,OAAO,CAAC,YAAY;oBAClC,UAAU;oBACV,KAAK,EAAE,CAAC;iBACT,CAAC,CAAA;gBACF,MAAK,CAAC,4BAA4B;YACpC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,eAAe,CAAA;AACxB,CAAC"}

package/dist/layer2/byok-patterns.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Layer 2: BYOK (Bring Your Own Key) Pattern Detection
+ * Distinguishes per-user BYOK flows from central/shared key storage
+ * BYOK is often a feature, not a vulnerability - severity depends on context
+ */
+import type { Vulnerability } from '../types';
+import type { MiddlewareAuthConfig } from '../utils/middleware-detector';
+/**
+ * Detect BYOK patterns and classify their risk level
+ */
+export declare function detectBYOKPatterns(content: string, filePath: string, middlewareConfig?: MiddlewareAuthConfig): Vulnerability[];
+//# sourceMappingURL=byok-patterns.d.ts.map

package/dist/layer2/byok-patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"byok-patterns.d.ts","sourceRoot":"","sources":["../../src/layer2/byok-patterns.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAyB,MAAM,UAAU,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AAkNxE;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,gBAAgB,CAAC,EAAE,oBAAoB,GACtC,aAAa,EAAE,CA+GjB"}

package/dist/layer2/byok-patterns.js

@@ -0,0 +1,299 @@
+"use strict";
+/**
+ * Layer 2: BYOK (Bring Your Own Key) Pattern Detection
+ * Distinguishes per-user BYOK flows from central/shared key storage
+ * BYOK is often a feature, not a vulnerability - severity depends on context
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectBYOKPatterns = detectBYOKPatterns;
+const context_helpers_1 = require("../utils/context-helpers");
+const middleware_detector_1 = require("../utils/middleware-detector");
+/**
+ * Check if line contains example/placeholder API key patterns
+ */
+function isExampleCredential(line) {
+    const examplePatterns = [
+        /your[-_]?api[-_]?key/i,
+        /example[-_]?api[-_]?key/i,
+        /sample[-_]?key/i,
+        /replace[-_]?with/i,
+        /placeholder/i,
+        /your[-_]?secret/i,
+        /example[-_]?secret/i,
+        /<.*api.*key.*>/i, // <YOUR_API_KEY>
+        /\[.*api.*key.*\]/i, // [API_KEY]
+        /xxx+/i,
+        /demo[-_]?key/i,
+        /test[-_]?key/i,
+        /fake[-_]?key/i,
+        /mock[-_]?key/i,
+    ];
+    return examplePatterns.some(p => p.test(line));
+}
+const BYOK_PATTERNS = [
+    // OpenAI API key patterns
+    {
+        name: 'User-provided OpenAI API key',
+        pattern: /(?:openai|api).*key.*(?:req\.|body\.|params\.|input\.|user)|(?:req\.|body\.|params\.).*(?:openai|api).*key/gi,
+        keyType: 'openai',
+        description: 'User-provided OpenAI API key detected',
+    },
+    {
+        name: 'OpenAI key from request',
+        pattern: /new\s+OpenAI\s*\(\s*\{[^}]*apiKey\s*:\s*(?:req|body|params|input)/gi,
+        keyType: 'openai',
+        description: 'OpenAI client initialized with user-provided key',
+    },
+    // Anthropic API key patterns
+    {
+        name: 'User-provided Anthropic API key',
+        pattern: /(?:anthropic|claude).*key.*(?:req\.|body\.|params\.|input\.|user)|(?:req\.|body\.|params\.).*(?:anthropic|claude).*key/gi,
+        keyType: 'anthropic',
+        description: 'User-provided Anthropic API key detected',
+    },
+    {
+        name: 'Anthropic key from request',
+        pattern: /new\s+Anthropic\s*\(\s*\{[^}]*apiKey\s*:\s*(?:req|body|params|input)/gi,
+        keyType: 'anthropic',
+        description: 'Anthropic client initialized with user-provided key',
+    },
+    // Generic AI key patterns
+    {
+        name: 'User-provided AI API key',
+        pattern: /(?:ai|llm|model).*(?:api)?.*key.*(?:req\.|body\.|params\.|input\.)/gi,
+        keyType: 'generic_ai',
+        description: 'User-provided AI API key detected',
+    },
+    // Generic key patterns (more cautious)
+    {
+        name: 'API key from user input',
+        pattern: /apiKey\s*[=:]\s*(?:req|body|params|input)\./gi,
+        keyType: 'generic',
+        description: 'API key received from user input',
+    },
+];
+/**
+ * Check if file has explicit authentication checks
+ */
+function hasExplicitAuthCheck(content) {
+    const authPatterns = [
+        // Common auth check functions
+        /getCurrentUser(Id)?\s*\(/i,
+        /getSession\s*\(/i,
+        /getServerSession\s*\(/i,
+        /auth\s*\(\s*\)/i,
+        /requireAuth\s*\(/i,
+        /verifyToken\s*\(/i,
+        /isAuthenticated/i,
+        /checkAuth\s*\(/i,
+        /withAuth\s*\(/i,
+        // Request user checks
+        /req\.user|request\.user/i,
+        /context\.user/i,
+        // Supabase auth
+        /supabase\.auth\.getUser/i,
+        /supabase\.auth\.getSession/i,
+        // NextAuth
+        /getServerSession\s*\(/i,
+        /useSession\s*\(/i,
+        // Clerk
+        /currentUser\s*\(/i,
+        /auth\(\)\.protect/i,
+    ];
+    return authPatterns.some(p => p.test(content));
+}
+/**
+ * Check if key appears to be stored to database
+ */
+function isKeyStoredToDatabase(content, lineNumber) {
+    const lines = content.split('\n');
+    const startLine = Math.max(0, lineNumber - 5);
+    const endLine = Math.min(lines.length, lineNumber + 15);
+    const context = lines.slice(startLine, endLine).join('\n');
+    // Patterns indicating database storage operations
+    // NOTE: We use specific patterns to avoid false positives with API calls like
+    // openai.chat.completions.create() or anthropic.messages.create()
+    const storagePatterns = [
+        /\.insert\s*\(/i,
+        /\.update\s*\(/i,
+        /\.upsert\s*\(/i,
+        /\.save\s*\(/i,
+        /INSERT\s+INTO/i,
+        /UPDATE\s+.*SET/i,
+        // ORM-specific patterns - must have table/model context
+        /prisma\.\w+\.create\s*\(/i,
+        /supabase\.from\(.*\)\.(?:insert|update|upsert)/i,
+        /db\.\w+\.create\s*\(/i,
+        /knex\(.*\)\.insert/i,
+        /\.collection\(.*\)\.(?:insertOne|updateOne|save)/i, // MongoDB
+        /sequelize\..*\.create\s*\(/i,
+        // localStorage/sessionStorage (client-side storage)
+        /localStorage\.setItem/i,
+        /sessionStorage\.setItem/i,
+    ];
+    // Exclude AI SDK patterns that use .create() for API calls, not storage
+    const aiApiPatterns = [
+        /openai\..*\.create/i,
+        /anthropic\..*\.create/i,
+        /\.chat\.completions\.create/i,
+        /\.messages\.create/i,
+        /\.completions\.create/i,
+        /\.embeddings\.create/i,
+    ];
+    const hasStoragePattern = storagePatterns.some(p => p.test(context));
+    const hasAiApiPattern = aiApiPatterns.some(p => p.test(context));
+    // Only consider it storage if we have storage patterns but NOT AI API patterns
+    // If both are present, check if storage patterns are separate from AI patterns
+    if (hasStoragePattern && hasAiApiPattern) {
+        // Check if there's a clear database storage operation separate from AI calls
+        // Look for keywords like 'user', 'key', 'credential' near storage patterns
+        return /(?:insert|update|upsert|save).*(?:apiKey|api_key|key|credential)/i.test(context) ||
+            /(?:apiKey|api_key|key|credential).*(?:insert|update|upsert|save)/i.test(context);
+    }
+    return hasStoragePattern;
+}
+/**
+ * Check if key is only used transiently (same request, not stored)
+ */
+function isTransientKeyUsage(content, lineNumber) {
+    const lines = content.split('\n');
+    const startLine = Math.max(0, lineNumber - 3);
+    const endLine = Math.min(lines.length, lineNumber + 20);
+    const context = lines.slice(startLine, endLine).join('\n');
+    // Transient usage patterns - key used immediately then discarded
+    const transientPatterns = [
+        /new\s+(?:OpenAI|Anthropic)\s*\(/i, // Immediate client creation
+        /\.create\s*\(\s*\{[^}]*messages/i, // Immediate API call
+        /\.completions\.create/i,
+        /\.messages\.create/i,
+        /await\s+(?:openai|anthropic|client)\./i,
+    ];
+    // If we see API calls but no storage, it's transient
+    const hasApiCalls = transientPatterns.some(p => p.test(context));
+    const hasStorage = isKeyStoredToDatabase(content, lineNumber);
+    return hasApiCalls && !hasStorage;
+}
+/**
+ * Check if key appears to be logged (bad practice)
+ */
+function isKeyLogged(content, lineNumber) {
+    const lines = content.split('\n');
+    const startLine = Math.max(0, lineNumber - 3);
+    const endLine = Math.min(lines.length, lineNumber + 10);
+    const context = lines.slice(startLine, endLine).join('\n');
+    const loggingPatterns = [
+        /console\.(log|info|debug|warn|error)\s*\([^)]*(?:apiKey|api_key|key)/i,
+        /logger\.(log|info|debug|warn|error)\s*\([^)]*(?:apiKey|api_key|key)/i,
+        /\.(log|info|debug|warn|error)\s*\(.*(?:apiKey|api_key|key)/i,
+    ];
+    return loggingPatterns.some(p => p.test(context));
+}
+/**
+ * Detect BYOK patterns and classify their risk level
+ */
+function detectBYOKPatterns(content, filePath, middlewareConfig) {
+    const vulnerabilities = [];
+    const lines = content.split('\n');
+    const isTestFile = (0, context_helpers_1.isTestOrMockFile)(filePath);
+    // Skip example/demo files entirely - they contain placeholder credentials by design
+    if ((0, context_helpers_1.isExampleFile)(filePath)) {
+        return vulnerabilities;
+    }
+    // Check route protection
+    const routePath = (0, middleware_detector_1.getRoutePathFromFile)(filePath);
+    const middlewareProtection = routePath && middlewareConfig
+        ? (0, middleware_detector_1.isRouteProtectedByMiddleware)(routePath, middlewareConfig)
+        : { isProtected: false, reason: '' };
+    // Check for user scoping patterns in the file
+    const userScoping = (0, middleware_detector_1.detectUserScopingPatterns)(content);
+    // Check for explicit auth in file content (more reliable than middleware detection)
+    const hasExplicitAuth = hasExplicitAuthCheck(content);
+    lines.forEach((line, index) => {
+        if ((0, context_helpers_1.isComment)(line))
+            return;
+        // Skip lines with example/placeholder credentials
+        if (isExampleCredential(line) || (0, context_helpers_1.isPlaceholderValue)('', line)) {
+            return;
+        }
+        for (const pattern of BYOK_PATTERNS) {
+            const regex = new RegExp(pattern.pattern.source, pattern.pattern.flags);
+            if (regex.test(line)) {
+                // Determine context
+                const isAuthenticated = middlewareProtection.isProtected || hasExplicitAuth;
+                const isUserScoped = userScoping.hasUserScoping;
+                const isStoredCentrally = isKeyStoredToDatabase(content, index);
+                const isTransient = isTransientKeyUsage(content, index);
+                // Determine severity based on context
+                let severity;
+                let description;
+                let suggestedFix;
+                if (isAuthenticated && isTransient) {
+                    // Authenticated and transient - this is the IDEAL BYOK pattern
+                    // Check if key is being logged (bad practice)
+                    const keyLogged = isKeyLogged(content, index);
+                    if (keyLogged) {
+                        severity = 'low';
+                        description = `BYOK feature detected: ${pattern.description}. Keys are used transiently (good!) but appear to be logged (avoid logging API keys, even in debug).`;
+                        suggestedFix = 'Remove logging of API keys. Best practices: (1) Validate API key format, (2) Add per-user rate limiting.';
+                    }
+                    else {
+                        // IDEAL PATTERN: Authenticated + transient + no logging = no issue
+                        // Skip emitting a finding entirely for the ideal case
+                        continue;
+                    }
+                }
+                else if (!isAuthenticated && isTransient) {
+                    // Unauthenticated but transient - still lower risk than storage
+                    severity = 'low';
+                    description = `BYOK feature detected: ${pattern.description}. Keys are used transiently (not stored). Consider adding authentication or rate limiting.`;
+                    suggestedFix = 'Consider adding authentication. If intentionally public: add rate limiting, key format validation, and usage tracking.';
+                }
+                else if (!isAuthenticated && isStoredCentrally) {
+                    // Unauthenticated AND storing keys - this is the real risk
+                    severity = 'medium';
+                    description = `${pattern.description}. This endpoint appears to lack authentication AND stores keys. This could allow unauthorized key storage.`;
+                    suggestedFix = 'Add authentication. Ensure stored keys are scoped by user_id with proper access controls.';
+                }
+                else if (isStoredCentrally && !isUserScoped) {
+                    // Authenticated but keys stored without user scoping - medium risk
+                    severity = 'medium';
+                    description = `${pattern.description}. Keys appear to be stored centrally without user-scoping, which could lead to cross-tenant key access.`;
+                    suggestedFix = 'Ensure stored keys are scoped by user_id. Add proper access controls to prevent users from accessing other users\' keys.';
+                }
+                else if (isAuthenticated && isUserScoped) {
+                    // Authenticated and user-scoped with storage - generally okay
+                    severity = 'info';
+                    description = `${pattern.description}. Route is authenticated and operations appear user-scoped. If keys are stored, consider encryption at rest.`;
+                    suggestedFix = 'If storing keys: consider encryption at rest. Add rate limiting to prevent cost abuse.';
+                }
+                else {
+                    // Authenticated but unclear scoping - needs review, but low priority
+                    severity = 'info';
+                    description = `${pattern.description}. Route is authenticated. This appears to be a BYOK feature.`;
+                    suggestedFix = 'Verify user-scoping for stored keys. Add rate limiting for cost control.';
+                }
+                // Downgrade test files
+                if (isTestFile) {
+                    severity = 'info';
+                    description = `${description} (in test file)`;
+                }
+                vulnerabilities.push({
+                    id: `byok-${filePath}-${index + 1}-${pattern.name}`,
+                    filePath,
+                    lineNumber: index + 1,
+                    lineContent: line.trim(),
+                    severity,
+                    category: 'ai_pattern',
+                    title: `BYOK: ${pattern.name}`,
+                    description,
+                    suggestedFix,
+                    confidence: isTestFile ? 'low' : 'medium',
+                    layer: 2,
+                });
+                break; // One finding per line
+            }
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=byok-patterns.js.map