@oculum/scanner 1.0.0

package/dist/utils/imported-auth-detector.js

@@ -0,0 +1,251 @@
+"use strict";
+/**
+ * Imported Auth Detector
+ *
+ * Detects auth middleware/helpers imported from other files to avoid
+ * false positives on routes that are actually protected via imports.
+ *
+ * Example: A route file that does `import { authMiddleware } from '@/lib/auth'`
+ * and wraps handlers with it should not be flagged as "missing auth".
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractImports = extractImports;
+exports.detectImportedAuthUsage = detectImportedAuthUsage;
+exports.buildFileAuthImports = buildFileAuthImports;
+exports.fileUsesImportedAuth = fileUsesImportedAuth;
+// ============================================================================
+// Patterns
+// ============================================================================
+/**
+ * Patterns that indicate auth-related imports by name
+ */
+const AUTH_NAME_PATTERNS = [
+    /auth/i,
+    /middleware/i,
+    /protect/i,
+    /guard/i,
+    /session/i,
+    /verify/i,
+    /secure/i,
+    /jwt/i,
+    /token/i,
+];
+/**
+ * Specific auth import names commonly used
+ */
+const KNOWN_AUTH_IMPORTS = new Set([
+    // Next.js / NextAuth
+    'auth',
+    'getServerSession',
+    'getSession',
+    'withAuth',
+    'getToken',
+    'NextAuth',
+    'NextAuthOptions',
+    // Clerk
+    'auth',
+    'currentUser',
+    'clerkMiddleware',
+    'getAuth',
+    'SignedIn',
+    'SignedOut',
+    // Auth0
+    'withPageAuthRequired',
+    'withApiAuthRequired',
+    'getSession',
+    'getAccessToken',
+    // Custom auth patterns
+    'authMiddleware',
+    'requireAuth',
+    'requireAuthentication',
+    'checkAuth',
+    'verifyAuth',
+    'protectRoute',
+    'withAuthentication',
+    'authenticated',
+    'getCurrentUser',
+    'getCurrentUserId',
+    'getUser',
+    'getUserId',
+]);
+/**
+ * Patterns indicating auth-related import paths
+ */
+const AUTH_PATH_PATTERNS = [
+    /\/auth\//i,
+    /\/middleware/i,
+    /\/lib\/auth/i,
+    /\/utils\/auth/i,
+    /\/helpers\/auth/i,
+    /next-auth/i,
+    /@clerk/i,
+    /@auth0/i,
+    /lucia/i,
+];
+// ============================================================================
+// Import Extraction
+// ============================================================================
+/**
+ * Extract all imports from a file's content
+ */
+function extractImports(content) {
+    const imports = [];
+    // ES6 named imports: import { x, y } from 'path'
+    const es6NamedPattern = /import\s+\{([^}]+)\}\s+from\s+['"]([^'"]+)['"]/g;
+    let match;
+    while ((match = es6NamedPattern.exec(content)) !== null) {
+        const names = match[1]
+            .split(',')
+            .map(n => n.trim().split(/\s+as\s+/)[0].trim()) // Handle 'x as y'
+            .filter(n => n.length > 0);
+        const importPath = match[2];
+        const isAuthRelated = isAuthRelatedImport(names, importPath);
+        imports.push({
+            importPath,
+            importedNames: names,
+            isAuthRelated,
+        });
+    }
+    // ES6 default imports: import x from 'path'
+    const defaultPattern = /import\s+(\w+)\s+from\s+['"]([^'"]+)['"]/g;
+    while ((match = defaultPattern.exec(content)) !== null) {
+        const name = match[1];
+        const importPath = match[2];
+        // Skip if already captured as named import
+        if (imports.some(imp => imp.importPath === importPath))
+            continue;
+        const isAuthRelated = isAuthRelatedImport([name], importPath);
+        imports.push({
+            importPath,
+            importedNames: [name],
+            isAuthRelated,
+        });
+    }
+    // CommonJS require: const { x } = require('path')
+    const requireDestructurePattern = /(?:const|let|var)\s+\{([^}]+)\}\s*=\s*require\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+    while ((match = requireDestructurePattern.exec(content)) !== null) {
+        const names = match[1]
+            .split(',')
+            .map(n => n.trim().split(/\s*:\s*/)[0].trim()) // Handle 'x: y' renaming
+            .filter(n => n.length > 0);
+        const importPath = match[2];
+        const isAuthRelated = isAuthRelatedImport(names, importPath);
+        imports.push({
+            importPath,
+            importedNames: names,
+            isAuthRelated,
+        });
+    }
+    // CommonJS require: const x = require('path')
+    const requireDefaultPattern = /(?:const|let|var)\s+(\w+)\s*=\s*require\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+    while ((match = requireDefaultPattern.exec(content)) !== null) {
+        const name = match[1];
+        const importPath = match[2];
+        // Skip if already captured
+        if (imports.some(imp => imp.importPath === importPath))
+            continue;
+        const isAuthRelated = isAuthRelatedImport([name], importPath);
+        imports.push({
+            importPath,
+            importedNames: [name],
+            isAuthRelated,
+        });
+    }
+    return imports;
+}
+/**
+ * Check if an import is auth-related based on names and path
+ */
+function isAuthRelatedImport(names, importPath) {
+    // Check if path is auth-related
+    if (AUTH_PATH_PATTERNS.some(p => p.test(importPath))) {
+        return true;
+    }
+    // Check if any imported name is auth-related
+    for (const name of names) {
+        // Known auth imports
+        if (KNOWN_AUTH_IMPORTS.has(name)) {
+            return true;
+        }
+        // Pattern-based detection
+        if (AUTH_NAME_PATTERNS.some(p => p.test(name))) {
+            return true;
+        }
+    }
+    return false;
+}
+// ============================================================================
+// Auth Usage Detection
+// ============================================================================
+/**
+ * Check if imported auth is actually used to protect routes/handlers
+ */
+function detectImportedAuthUsage(content, authImports) {
+    if (authImports.length === 0)
+        return false;
+    const authNames = authImports.flatMap(imp => imp.importedNames);
+    for (const name of authNames) {
+        // Pattern 1: Handler wrapping - export const GET = authMiddleware(...)
+        const wrapperPattern = new RegExp(`(?:export\\s+(?:const|function)\\s+(?:GET|POST|PUT|PATCH|DELETE|handler)\\s*=\\s*${escapeRegex(name)}\\s*\\()` +
+            `|(?:${escapeRegex(name)}\\s*\\(\\s*(?:async\\s+)?(?:function|\\())`);
+        if (wrapperPattern.test(content)) {
+            return true;
+        }
+        // Pattern 2: Middleware chain - app.use(authMiddleware)
+        const middlewareChainPattern = new RegExp(`\\.(?:use|all|get|post|put|patch|delete)\\s*\\([^)]*${escapeRegex(name)}`);
+        if (middlewareChainPattern.test(content)) {
+            return true;
+        }
+        // Pattern 3: Express/Fastify route with middleware - router.get('/', requireAuth, handler)
+        const routeMiddlewarePattern = new RegExp(`\\.(?:get|post|put|patch|delete)\\s*\\([^,]+,\\s*${escapeRegex(name)}`);
+        if (routeMiddlewarePattern.test(content)) {
+            return true;
+        }
+        // Pattern 4: HOC pattern - withAuth(Component)
+        const hocPattern = new RegExp(`${escapeRegex(name)}\\s*\\(\\s*\\w+\\s*\\)`);
+        if (hocPattern.test(content)) {
+            return true;
+        }
+        // Pattern 5: Auth function call at top of handler - const session = await auth()
+        const authCallPattern = new RegExp(`(?:await\\s+)?${escapeRegex(name)}\\s*\\(\\s*\\)` +
+            `|${escapeRegex(name)}\\s*\\(\\s*(?:req|request|ctx|context)\\s*[,)]`);
+        if (authCallPattern.test(content)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Escape special regex characters in a string
+ */
+function escapeRegex(str) {
+    return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+// ============================================================================
+// Registry Builder
+// ============================================================================
+/**
+ * Build a registry of files and their auth imports
+ */
+function buildFileAuthImports(files) {
+    const registry = new Map();
+    for (const file of files) {
+        const allImports = extractImports(file.content);
+        const authImports = allImports.filter(imp => imp.isAuthRelated);
+        const usesImportedAuth = authImports.length > 0 &&
+            detectImportedAuthUsage(file.content, authImports);
+        registry.set(file.path, {
+            filePath: file.path,
+            imports: authImports,
+            usesImportedAuth,
+        });
+    }
+    return registry;
+}
+/**
+ * Check if a specific file uses imported auth protection
+ */
+function fileUsesImportedAuth(filePath, registry) {
+    return registry.get(filePath)?.usesImportedAuth ?? false;
+}
+//# sourceMappingURL=imported-auth-detector.js.map

package/dist/utils/imported-auth-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"imported-auth-detector.js","sourceRoot":"","sources":["../../src/utils/imported-auth-detector.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAuGH,wCA8EC;AAkCD,0DAmDC;AAgBD,oDAmBC;AAKD,oDAKC;AAnSD,+EAA+E;AAC/E,WAAW;AACX,+EAA+E;AAE/E;;GAEG;AACH,MAAM,kBAAkB,GAAG;IACzB,OAAO;IACP,aAAa;IACb,UAAU;IACV,QAAQ;IACR,UAAU;IACV,SAAS;IACT,SAAS;IACT,MAAM;IACN,QAAQ;CACT,CAAA;AAED;;GAEG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,qBAAqB;IACrB,MAAM;IACN,kBAAkB;IAClB,YAAY;IACZ,UAAU;IACV,UAAU;IACV,UAAU;IACV,iBAAiB;IAEjB,QAAQ;IACR,MAAM;IACN,aAAa;IACb,iBAAiB;IACjB,SAAS;IACT,UAAU;IACV,WAAW;IAEX,QAAQ;IACR,sBAAsB;IACtB,qBAAqB;IACrB,YAAY;IACZ,gBAAgB;IAEhB,uBAAuB;IACvB,gBAAgB;IAChB,aAAa;IACb,uBAAuB;IACvB,WAAW;IACX,YAAY;IACZ,cAAc;IACd,oBAAoB;IACpB,eAAe;IACf,gBAAgB;IAChB,kBAAkB;IAClB,SAAS;IACT,WAAW;CACZ,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,kBAAkB,GAAG;IACzB,WAAW;IACX,eAAe;IACf,cAAc;IACd,gBAAgB;IAChB,kBAAkB;IAClB,YAAY;IACZ,SAAS;IACT,SAAS;IACT,QAAQ;CACT,CAAA;AAED,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;GAEG;AACH,SAAgB,cAAc,CAAC,OAAe;IAC5C,MAAM,OAAO,GAAuB,EAAE,CAAA;IAEtC,iDAAiD;IACjD,MAAM,eAAe,GAAG,iDAAiD,CAAA;IACzE,IAAI,KAAK,CAAA;IAET,OAAO,CAAC,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC;aACnB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAE,kBAAkB;aAClE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QAC5B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QAE3B,MAAM,aAAa,GAAG,mBAAmB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;QAE5D,OAAO,CAAC,IAAI,CAAC;YACX,UAAU;YACV,aAAa,EAAE,KAAK;YACpB,aAAa;SACd,CAAC,CAAA;IACJ,CAAC;IAED,4CAA4C;IAC5C,MAAM,cAAc,GAAG,2CAA2C,CAAA;IAClE,OAAO,CAAC,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QAE3B,2CAA2C;QAC3C,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,UAAU,CAAC;YAAE,SAAQ;QAEhE,MAAM,aAAa,GAAG,mBAAmB,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAA;QAE7D,OAAO,CAAC,IAAI,CAAC;YACX,UAAU;YACV,aAAa,EAAE,CAAC,IAAI,CAAC;YACrB,aAAa;SACd,CAAC,CAAA;IACJ,CAAC;IAED,kDAAkD;IAClD,MAAM,yBAAyB,GAAG,6EAA6E,CAAA;IAC/G,OAAO,CAAC,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAClE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC;aACnB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAE,yBAAyB;aACxE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QAC5B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QAE3B,MAAM,aAAa,GAAG,mBAAmB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;QAE5D,OAAO,CAAC,IAAI,CAAC;YACX,UAAU;YACV,aAAa,EAAE,KAAK;YACpB,aAAa;SACd,CAAC,CAAA;IACJ,CAAC;IAED,8CAA8C;IAC9C,MAAM,qBAAqB,GAAG,uEAAuE,CAAA;IACrG,OAAO,CAAC,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QAE3B,2BAA2B;QAC3B,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,UAAU,CAAC;YAAE,SAAQ;QAEhE,MAAM,aAAa,GAAG,mBAAmB,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAA;QAE7D,OAAO,CAAC,IAAI,CAAC;YACX,UAAU;YACV,aAAa,EAAE,CAAC,IAAI,CAAC;YACrB,aAAa;SACd,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,KAAe,EAAE,UAAkB;IAC9D,gCAAgC;IAChC,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACrD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,6CAA6C;IAC7C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,qBAAqB;QACrB,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,IAAI,CAAA;QACb,CAAC;QAED,0BAA0B;QAC1B,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E;;GAEG;AACH,SAAgB,uBAAuB,CACrC,OAAe,EACf,WAA+B;IAE/B,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAE1C,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IAE/D,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,uEAAuE;QACvE,MAAM,cAAc,GAAG,IAAI,MAAM,CAC/B,oFAAoF,WAAW,CAAC,IAAI,CAAC,UAAU;YAC/G,OAAO,WAAW,CAAC,IAAI,CAAC,4CAA4C,CACrE,CAAA;QACD,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,IAAI,CAAA;QACb,CAAC;QAED,wDAAwD;QACxD,MAAM,sBAAsB,GAAG,IAAI,MAAM,CACvC,uDAAuD,WAAW,CAAC,IAAI,CAAC,EAAE,CAC3E,CAAA;QACD,IAAI,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,OAAO,IAAI,CAAA;QACb,CAAC;QAED,2FAA2F;QAC3F,MAAM,sBAAsB,GAAG,IAAI,MAAM,CACvC,oDAAoD,WAAW,CAAC,IAAI,CAAC,EAAE,CACxE,CAAA;QACD,IAAI,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,OAAO,IAAI,CAAA;QACb,CAAC;QAED,+CAA+C;QAC/C,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QAC3E,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAA;QACb,CAAC;QAED,iFAAiF;QACjF,MAAM,eAAe,GAAG,IAAI,MAAM,CAChC,iBAAiB,WAAW,CAAC,IAAI,CAAC,gBAAgB;YAClD,IAAI,WAAW,CAAC,IAAI,CAAC,gDAAgD,CACtE,CAAA;QACD,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;AACnD,CAAC;AAED,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E;;GAEG;AACH,SAAgB,oBAAoB,CAAC,KAAiB;IACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAA;IAEnD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC/C,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;QAE/D,MAAM,gBAAgB,GACpB,WAAW,CAAC,MAAM,GAAG,CAAC;YACtB,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;QAEpD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE;YACtB,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,OAAO,EAAE,WAAW;YACpB,gBAAgB;SACjB,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;GAEG;AACH,SAAgB,oBAAoB,CAClC,QAAgB,EAChB,QAAsC;IAEtC,OAAO,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,gBAAgB,IAAI,KAAK,CAAA;AAC1D,CAAC"}

package/dist/utils/middleware-detector.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Middleware Auth Detection
+ * Detects global authentication middleware (Next.js, Express, etc.)
+ * and determines which routes are protected
+ */
+import type { ScanFile } from '../types';
+/**
+ * Configuration describing detected auth middleware
+ */
+export interface MiddlewareAuthConfig {
+    /** Whether auth middleware was detected */
+    hasAuthMiddleware: boolean;
+    /** The type of auth detected */
+    authType?: 'clerk' | 'nextauth' | 'auth0' | 'custom' | 'unknown';
+    /** File path where middleware was found */
+    middlewareFile?: string;
+    /** Protected path patterns (glob-like) */
+    protectedPaths: string[];
+    /** Public/excluded path patterns */
+    publicPaths: string[];
+    /** Raw matcher patterns found */
+    matchers: string[];
+    /** Additional context about the auth setup */
+    context: {
+        usesAuthProtect: boolean;
+        usesGetToken: boolean;
+        usesSession: boolean;
+        hasPublicRoutes: boolean;
+    };
+}
+/**
+ * Detect global auth middleware from scanned files
+ * Looks for Next.js middleware.ts, Express auth patterns, etc.
+ */
+export declare function detectGlobalAuthMiddleware(files: ScanFile[]): MiddlewareAuthConfig;
+/**
+ * Check if a given route path is protected by the middleware
+ */
+export declare function isRouteProtectedByMiddleware(routePath: string, config: MiddlewareAuthConfig): {
+    isProtected: boolean;
+    reason: string;
+};
+/**
+ * Extract route path from a file path (e.g., app/api/users/route.ts -> /api/users)
+ */
+export declare function getRoutePathFromFile(filePath: string): string | null;
+/**
+ * Get user-scoping patterns from file content
+ * Detects patterns like: user_id, userId, session.user.id
+ */
+export declare function detectUserScopingPatterns(content: string): {
+    hasUserScoping: boolean;
+    patterns: string[];
+};
+//# sourceMappingURL=middleware-detector.d.ts.map

package/dist/utils/middleware-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware-detector.d.ts","sourceRoot":"","sources":["../../src/utils/middleware-detector.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAExC;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,2CAA2C;IAC3C,iBAAiB,EAAE,OAAO,CAAA;IAC1B,gCAAgC;IAChC,QAAQ,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAA;IAChE,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,0CAA0C;IAC1C,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,oCAAoC;IACpC,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,iCAAiC;IACjC,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,8CAA8C;IAC9C,OAAO,EAAE;QACP,eAAe,EAAE,OAAO,CAAA;QACxB,YAAY,EAAE,OAAO,CAAA;QACrB,WAAW,EAAE,OAAO,CAAA;QACpB,eAAe,EAAE,OAAO,CAAA;KACzB,CAAA;CACF;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,oBAAoB,CAwDlF;AA0GD;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,oBAAoB,GAC3B;IAAE,WAAW,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CA6C1C;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgBpE;AA2BD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG;IAC1D,cAAc,EAAE,OAAO,CAAA;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB,CA2BA"}

package/dist/utils/middleware-detector.js

@@ -0,0 +1,260 @@
+"use strict";
+/**
+ * Middleware Auth Detection
+ * Detects global authentication middleware (Next.js, Express, etc.)
+ * and determines which routes are protected
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectGlobalAuthMiddleware = detectGlobalAuthMiddleware;
+exports.isRouteProtectedByMiddleware = isRouteProtectedByMiddleware;
+exports.getRoutePathFromFile = getRoutePathFromFile;
+exports.detectUserScopingPatterns = detectUserScopingPatterns;
+/**
+ * Detect global auth middleware from scanned files
+ * Looks for Next.js middleware.ts, Express auth patterns, etc.
+ */
+function detectGlobalAuthMiddleware(files) {
+    const result = {
+        hasAuthMiddleware: false,
+        protectedPaths: [],
+        publicPaths: [],
+        matchers: [],
+        context: {
+            usesAuthProtect: false,
+            usesGetToken: false,
+            usesSession: false,
+            hasPublicRoutes: false,
+        },
+    };
+    // Find middleware files
+    const middlewareFile = files.find(f => /^(src\/)?middleware\.(ts|js)$/.test(f.path) ||
+        f.path.endsWith('/middleware.ts') ||
+        f.path.endsWith('/middleware.js'));
+    if (!middlewareFile) {
+        return result;
+    }
+    result.middlewareFile = middlewareFile.path;
+    const content = middlewareFile.content;
+    // Detect auth provider type
+    result.authType = detectAuthType(content);
+    if (result.authType) {
+        result.hasAuthMiddleware = true;
+    }
+    // Extract protected path matchers
+    const { protectedPaths, publicPaths, matchers } = extractPathMatchers(content);
+    result.protectedPaths = protectedPaths;
+    result.publicPaths = publicPaths;
+    result.matchers = matchers;
+    // Detect specific auth patterns
+    result.context.usesAuthProtect = /auth\.protect\(\)|auth\(\)\.protect\(\)|requireAuth\(\)/i.test(content);
+    result.context.usesGetToken = /getToken\(|getAuth\(/i.test(content);
+    result.context.usesSession = /getSession\(|getServerSession\(/i.test(content);
+    result.context.hasPublicRoutes = /isPublicRoute|publicRoutes|ignoredRoutes|excludedPaths/i.test(content);
+    // If we found auth imports but no explicit matchers, assume /api/** is protected
+    if (result.hasAuthMiddleware && result.protectedPaths.length === 0) {
+        // Check if middleware runs on all routes or has default API protection
+        if (!result.context.hasPublicRoutes || /\/api/i.test(content)) {
+            result.protectedPaths.push('/api/**');
+        }
+    }
+    return result;
+}
+/**
+ * Detect which auth provider/library is being used
+ */
+function detectAuthType(content) {
+    // Clerk patterns
+    if (/clerkMiddleware|@clerk\/nextjs|clerkClient|auth\(\)\.protect/i.test(content)) {
+        return 'clerk';
+    }
+    // NextAuth patterns
+    if (/next-auth|NextAuth|getServerSession|withAuth\(/i.test(content)) {
+        return 'nextauth';
+    }
+    // Auth0 patterns
+    if (/@auth0\/nextjs|withPageAuthRequired|withApiAuthRequired/i.test(content)) {
+        return 'auth0';
+    }
+    // Generic auth middleware patterns
+    if (/authMiddleware|requireAuth|verifyToken|checkAuth|isAuthenticated/i.test(content)) {
+        return 'custom';
+    }
+    // Check for common auth imports/usage that suggest middleware is doing auth
+    if (/authorization|bearer|jwt|session\.user|getToken/i.test(content)) {
+        return 'unknown';
+    }
+    return undefined;
+}
+/**
+ * Extract path matchers from middleware config
+ */
+function extractPathMatchers(content) {
+    const protectedPaths = [];
+    const publicPaths = [];
+    const matchers = [];
+    // Next.js config.matcher pattern
+    // export const config = { matcher: [...] }
+    const matcherArrayMatch = content.match(/config\s*=\s*\{[^}]*matcher\s*:\s*\[([\s\S]*?)\]/m);
+    if (matcherArrayMatch) {
+        const matcherContent = matcherArrayMatch[1];
+        // Extract string patterns from the array
+        const patterns = matcherContent.match(/['"`]([^'"`]+)['"`]/g) || [];
+        for (const p of patterns) {
+            const path = p.replace(/['"`]/g, '');
+            matchers.push(path);
+            // Classify as protected or public based on common patterns
+            if (path.includes('/api') || path.includes('/(protected)') || path.includes('/dashboard')) {
+                protectedPaths.push(path);
+            }
+        }
+    }
+    // Single matcher pattern
+    // export const config = { matcher: '/api/:path*' }
+    const singleMatcherMatch = content.match(/config\s*=\s*\{[^}]*matcher\s*:\s*['"`]([^'"`]+)['"`]/m);
+    if (singleMatcherMatch) {
+        const path = singleMatcherMatch[1];
+        matchers.push(path);
+        if (path.includes('/api')) {
+            protectedPaths.push(path);
+        }
+    }
+    // Clerk-specific: createRouteMatcher for public routes
+    // const isPublicRoute = createRouteMatcher(['/sign-in', '/sign-up', ...])
+    const publicRouteMatch = content.match(/createRouteMatcher\s*\(\s*\[([\s\S]*?)\]/m);
+    if (publicRouteMatch) {
+        const routeContent = publicRouteMatch[1];
+        const patterns = routeContent.match(/['"`]([^'"`]+)['"`]/g) || [];
+        for (const p of patterns) {
+            const path = p.replace(/['"`]/g, '');
+            publicPaths.push(path);
+        }
+    }
+    // Look for publicRoutes/ignoredRoutes arrays
+    const publicRoutesMatch = content.match(/(publicRoutes|ignoredRoutes|excludedPaths)\s*[=:]\s*\[([\s\S]*?)\]/m);
+    if (publicRoutesMatch) {
+        const routeContent = publicRoutesMatch[2];
+        const patterns = routeContent.match(/['"`]([^'"`]+)['"`]/g) || [];
+        for (const p of patterns) {
+            const path = p.replace(/['"`]/g, '');
+            publicPaths.push(path);
+        }
+    }
+    // If we found public paths but no explicit protected paths,
+    // assume everything else under /api is protected
+    if (publicPaths.length > 0 && protectedPaths.length === 0) {
+        protectedPaths.push('/api/**');
+    }
+    return { protectedPaths, publicPaths, matchers };
+}
+/**
+ * Check if a given route path is protected by the middleware
+ */
+function isRouteProtectedByMiddleware(routePath, config) {
+    if (!config.hasAuthMiddleware) {
+        return { isProtected: false, reason: 'No auth middleware detected' };
+    }
+    // Normalize path
+    const normalizedPath = routePath.startsWith('/') ? routePath : `/${routePath}`;
+    // Check if explicitly public
+    for (const publicPath of config.publicPaths) {
+        if (matchPath(normalizedPath, publicPath)) {
+            return { isProtected: false, reason: `Matches public route pattern: ${publicPath}` };
+        }
+    }
+    // Check if explicitly protected
+    for (const protectedPath of config.protectedPaths) {
+        if (matchPath(normalizedPath, protectedPath)) {
+            return {
+                isProtected: true,
+                reason: `Protected by ${config.authType || 'auth'} middleware (matches: ${protectedPath})`,
+            };
+        }
+    }
+    // Check matchers
+    for (const matcher of config.matchers) {
+        if (matchPath(normalizedPath, matcher)) {
+            return {
+                isProtected: true,
+                reason: `Protected by middleware matcher: ${matcher}`,
+            };
+        }
+    }
+    // Default: if we have auth middleware and no explicit public match,
+    // consider API routes as protected
+    if (normalizedPath.startsWith('/api/')) {
+        return {
+            isProtected: true,
+            reason: `API route likely protected by ${config.authType || 'auth'} middleware`,
+        };
+    }
+    return { isProtected: false, reason: 'Route not covered by middleware matchers' };
+}
+/**
+ * Extract route path from a file path (e.g., app/api/users/route.ts -> /api/users)
+ */
+function getRoutePathFromFile(filePath) {
+    // Next.js App Router: app/api/users/route.ts -> /api/users
+    const appRouterMatch = filePath.match(/app(\/.*?)\/route\.(ts|js)$/i);
+    if (appRouterMatch) {
+        return appRouterMatch[1];
+    }
+    // Next.js Pages Router: pages/api/users.ts -> /api/users
+    const pagesRouterMatch = filePath.match(/pages(\/api\/.*?)\.(ts|js)$/i);
+    if (pagesRouterMatch) {
+        return pagesRouterMatch[1];
+    }
+    // Express-style routes: routes/users.ts (harder to determine path)
+    // Return null for now - would need more context
+    return null;
+}
+/**
+ * Simple glob-like path matching
+ * Supports: ** (any path), * (single segment), :param (path params)
+ */
+function matchPath(actualPath, pattern) {
+    // Normalize
+    const normActual = actualPath.replace(/\/+/g, '/');
+    let normPattern = pattern.replace(/\/+/g, '/');
+    // Handle Next.js :path* patterns
+    normPattern = normPattern
+        .replace(/:path\*/g, '**')
+        .replace(/:\w+/g, '[^/]+');
+    // Convert glob to regex
+    const regexPattern = normPattern
+        .replace(/\*\*/g, '<<<DOUBLESTAR>>>')
+        .replace(/\*/g, '[^/]*')
+        .replace(/<<<DOUBLESTAR>>>/g, '.*')
+        .replace(/\//g, '\\/');
+    const regex = new RegExp(`^${regexPattern}$`);
+    return regex.test(normActual);
+}
+/**
+ * Get user-scoping patterns from file content
+ * Detects patterns like: user_id, userId, session.user.id
+ */
+function detectUserScopingPatterns(content) {
+    const patterns = [];
+    // Common user ID patterns in queries/operations
+    const userIdPatterns = [
+        /\.eq\s*\(\s*['"`]user_id['"`]/i, // Supabase .eq('user_id', ...)
+        /\.filter\s*\(\s*user_id\s*=/i, // Django-style
+        /where\s*\(\s*['"`]?user_id['"`]?\s*=/i, // SQL-like
+        /userId\s*[=:]/i, // Generic userId
+        /user\.id\s*[=:]/i, // user.id
+        /session\.user\.id/i, // Next.js session
+        /req\.user\.id/i, // Express req.user
+        /getCurrentUserId\s*\(/i, // Custom helper
+        /getAuthUser\s*\(/i, // Auth helper
+        /auth\(\).*\.userId/i, // Clerk auth().userId
+    ];
+    for (const pattern of userIdPatterns) {
+        if (pattern.test(content)) {
+            patterns.push(pattern.source);
+        }
+    }
+    return {
+        hasUserScoping: patterns.length > 0,
+        patterns,
+    };
+}
+//# sourceMappingURL=middleware-detector.js.map

package/dist/utils/middleware-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware-detector.js","sourceRoot":"","sources":["../../src/utils/middleware-detector.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAiCH,gEAwDC;AA6GD,oEAgDC;AAKD,oDAgBC;AA+BD,8DA8BC;AA3SD;;;GAGG;AACH,SAAgB,0BAA0B,CAAC,KAAiB;IAC1D,MAAM,MAAM,GAAyB;QACnC,iBAAiB,EAAE,KAAK;QACxB,cAAc,EAAE,EAAE;QAClB,WAAW,EAAE,EAAE;QACf,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE;YACP,eAAe,EAAE,KAAK;YACtB,YAAY,EAAE,KAAK;YACnB,WAAW,EAAE,KAAK;YAClB,eAAe,EAAE,KAAK;SACvB;KACF,CAAA;IAED,wBAAwB;IACxB,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACpC,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5C,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACjC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAClC,CAAA;IAED,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,MAAM,CAAA;IACf,CAAC;IAED,MAAM,CAAC,cAAc,GAAG,cAAc,CAAC,IAAI,CAAA;IAC3C,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAA;IAEtC,4BAA4B;IAC5B,MAAM,CAAC,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;IAEzC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAA;IACjC,CAAC;IAED,kCAAkC;IAClC,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAC9E,MAAM,CAAC,cAAc,GAAG,cAAc,CAAA;IACtC,MAAM,CAAC,WAAW,GAAG,WAAW,CAAA;IAChC,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAE1B,gCAAgC;IAChC,MAAM,CAAC,OAAO,CAAC,eAAe,GAAG,0DAA0D,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACzG,MAAM,CAAC,OAAO,CAAC,YAAY,GAAG,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACnE,MAAM,CAAC,OAAO,CAAC,WAAW,GAAG,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC7E,MAAM,CAAC,OAAO,CAAC,eAAe,GAAG,yDAAyD,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAExG,iFAAiF;IACjF,IAAI,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,uEAAuE;QACvE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9D,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACvC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,OAAe;IACrC,iBAAiB;IACjB,IAAI,+DAA+D,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAClF,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,oBAAoB;IACpB,IAAI,iDAAiD,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACpE,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,iBAAiB;IACjB,IAAI,0DAA0D,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7E,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,mCAAmC;IACnC,IAAI,mEAAmE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACtF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,4EAA4E;IAC5E,IAAI,kDAAkD,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrE,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,OAAe;IAK1C,MAAM,cAAc,GAAa,EAAE,CAAA;IACnC,MAAM,WAAW,GAAa,EAAE,CAAA;IAChC,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,iCAAiC;IACjC,2CAA2C;IAC3C,MAAM,iBAAiB,GAAG,OAAO,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAA;IAC5F,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,cAAc,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAA;QAC3C,yCAAyC;QACzC,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAA;QACnE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;YACpC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACnB,2DAA2D;YAC3D,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC1F,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,mDAAmD;IACnD,MAAM,kBAAkB,GAAG,OAAO,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAClG,IAAI,kBAAkB,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAA;QAClC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnB,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,0EAA0E;IAC1E,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAA;IACnF,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,YAAY,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QACxC,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAA;QACjE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;YACpC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACxB,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,MAAM,iBAAiB,GAAG,OAAO,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAA;IAC9G,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,YAAY,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAA;QACzC,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAA;QACjE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;YACpC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACxB,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,iDAAiD;IACjD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAChC,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAA;AAClD,CAAC;AAED;;GAEG;AACH,SAAgB,4BAA4B,CAC1C,SAAiB,EACjB,MAA4B;IAE5B,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC9B,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAA;IACtE,CAAC;IAED,iBAAiB;IACjB,MAAM,cAAc,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAA;IAE9E,6BAA6B;IAC7B,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,SAAS,CAAC,cAAc,EAAE,UAAU,CAAC,EAAE,CAAC;YAC1C,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,UAAU,EAAE,EAAE,CAAA;QACtF,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAClD,IAAI,SAAS,CAAC,cAAc,EAAE,aAAa,CAAC,EAAE,CAAC;YAC7C,OAAO;gBACL,WAAW,EAAE,IAAI;gBACjB,MAAM,EAAE,gBAAgB,MAAM,CAAC,QAAQ,IAAI,MAAM,yBAAyB,aAAa,GAAG;aAC3F,CAAA;QACH,CAAC;IACH,CAAC;IAED,iBAAiB;IACjB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,SAAS,CAAC,cAAc,EAAE,OAAO,CAAC,EAAE,CAAC;YACvC,OAAO;gBACL,WAAW,EAAE,IAAI;gBACjB,MAAM,EAAE,oCAAoC,OAAO,EAAE;aACtD,CAAA;QACH,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,mCAAmC;IACnC,IAAI,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,OAAO;YACL,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,iCAAiC,MAAM,CAAC,QAAQ,IAAI,MAAM,aAAa;SAChF,CAAA;IACH,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAA;AACnF,CAAC;AAED;;GAEG;AACH,SAAgB,oBAAoB,CAAC,QAAgB;IACnD,2DAA2D;IAC3D,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACrE,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,cAAc,CAAC,CAAC,CAAC,CAAA;IAC1B,CAAC;IAED,yDAAyD;IACzD,MAAM,gBAAgB,GAAG,QAAQ,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACvE,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,gBAAgB,CAAC,CAAC,CAAC,CAAA;IAC5B,CAAC;IAED,mEAAmE;IACnE,gDAAgD;IAChD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,UAAkB,EAAE,OAAe;IACpD,YAAY;IACZ,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAClD,IAAI,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAE9C,iCAAiC;IACjC,WAAW,GAAG,WAAW;SACtB,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC;SACzB,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAE5B,wBAAwB;IACxB,MAAM,YAAY,GAAG,WAAW;SAC7B,OAAO,CAAC,OAAO,EAAE,kBAAkB,CAAC;SACpC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;SACvB,OAAO,CAAC,mBAAmB,EAAE,IAAI,CAAC;SAClC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAExB,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,YAAY,GAAG,CAAC,CAAA;IAC7C,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;AAC/B,CAAC;AAED;;;GAGG;AACH,SAAgB,yBAAyB,CAAC,OAAe;IAIvD,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,gDAAgD;IAChD,MAAM,cAAc,GAAG;QACrB,gCAAgC,EAAS,+BAA+B;QACxE,8BAA8B,EAAY,eAAe;QACzD,uCAAuC,EAAG,WAAW;QACrD,gBAAgB,EAA2B,iBAAiB;QAC5D,kBAAkB,EAAyB,UAAU;QACrD,oBAAoB,EAAuB,kBAAkB;QAC7D,gBAAgB,EAA2B,mBAAmB;QAC9D,wBAAwB,EAAmB,gBAAgB;QAC3D,mBAAmB,EAAwB,cAAc;QACzD,qBAAqB,EAAsB,sBAAsB;KAClE,CAAA;IAED,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC;IAED,OAAO;QACL,cAAc,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC;QACnC,QAAQ;KACT,CAAA;AACH,CAAC"}

package/dist/utils/oauth-flow-detector.d.ts

@@ -0,0 +1,41 @@
+/**
+ * OAuth Flow Detector
+ * Detects OAuth state generation and validation across multiple files
+ * to prevent false positives when state is implemented correctly but split across files.
+ */
+import type { ScanFile } from '../types';
+export interface OAuthFlowContext {
+    /** Whether state generation is detected in any file */
+    hasStateGeneration: boolean;
+    /** File where state is generated */
+    stateGenerationFile?: string;
+    /** Line number where state is generated */
+    stateGenerationLine?: number;
+    /** Whether state validation is detected in any file */
+    hasStateValidation: boolean;
+    /** File where state is validated */
+    stateValidationFile?: string;
+    /** Line number where state is validated */
+    stateValidationLine?: number;
+    /** Whether PKCE code_verifier is used */
+    hasCodeVerifier: boolean;
+    /** File where code_verifier is generated */
+    codeVerifierFile?: string;
+    /** Detected OAuth flow type */
+    flowType: 'authorization_code' | 'client_credentials' | 'implicit' | 'pkce' | 'unknown';
+    /** OAuth providers detected */
+    providers: string[];
+}
+/**
+ * Detect OAuth flow patterns across multiple files
+ */
+export declare function detectOAuthFlow(files: ScanFile[]): OAuthFlowContext;
+/**
+ * Check if OAuth state is properly implemented across files
+ */
+export declare function isOAuthStateImplemented(context: OAuthFlowContext): boolean;
+/**
+ * Get a summary of the OAuth flow for logging/context
+ */
+export declare function getOAuthFlowSummary(context: OAuthFlowContext): string;
+//# sourceMappingURL=oauth-flow-detector.d.ts.map

package/dist/utils/oauth-flow-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-flow-detector.d.ts","sourceRoot":"","sources":["../../src/utils/oauth-flow-detector.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAExC,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,kBAAkB,EAAE,OAAO,CAAA;IAC3B,oCAAoC;IACpC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,2CAA2C;IAC3C,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,uDAAuD;IACvD,kBAAkB,EAAE,OAAO,CAAA;IAC3B,oCAAoC;IACpC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,2CAA2C;IAC3C,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,yCAAyC;IACzC,eAAe,EAAE,OAAO,CAAA;IACxB,4CAA4C;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,+BAA+B;IAC/B,QAAQ,EAAE,oBAAoB,GAAG,oBAAoB,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,CAAA;IACvF,+BAA+B;IAC/B,SAAS,EAAE,MAAM,EAAE,CAAA;CACpB;AAoFD;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CA4EnE;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAa1E;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CA8BrE"}