@oculum/scanner 1.0.11 → 1.0.13

package/dist/model/auth-helper-detector.js

@@ -0,0 +1,360 @@
+"use strict";
+/**
+ * Auth Helper Detector
+ *
+ * Detects authentication helper functions that throw on missing auth,
+ * return non-null types, and provide security guarantees.
+ *
+ * When these helpers are called, subsequent code is GUARANTEED to have
+ * an authenticated user - no additional `if (!userId)` checks are needed.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectAuthHelpers = detectAuthHelpers;
+exports.usesThrowingAuthHelper = usesThrowingAuthHelper;
+exports.hasAuthHelperCallBefore = hasAuthHelperCallBefore;
+exports.isUserIdAlreadyValidated = isUserIdAlreadyValidated;
+// ============================================================================
+// Well-Known Auth Helper Patterns
+// ============================================================================
+/**
+ * Common patterns for auth helpers that THROW on missing auth
+ * These are functions that guarantee authenticated context after call
+ */
+const THROWING_AUTH_HELPER_PATTERNS = [
+    // Generic patterns
+    {
+        namePattern: /^(get|fetch|require|ensure)(Current)?(User|UserId|Auth|Session|Principal)(Id)?$/i,
+        callPattern: /\b(get|fetch|require|ensure)(Current)?(User|UserId|Auth|Session|Principal)(Id)?\s*\(/gi,
+        description: 'Auth helper that retrieves authenticated user',
+    },
+    // Clerk patterns
+    {
+        namePattern: /^auth$/,
+        callPattern: /\bauth\s*\(\s*\)/gi,
+        description: 'Clerk auth() helper',
+    },
+    {
+        namePattern: /^currentUser$/,
+        callPattern: /\bcurrentUser\s*\(\s*\)/gi,
+        description: 'Clerk currentUser() helper',
+    },
+    // NextAuth patterns
+    {
+        namePattern: /^getServerSession$/,
+        callPattern: /\bgetServerSession\s*\(/gi,
+        description: 'NextAuth getServerSession()',
+    },
+    {
+        namePattern: /^getSession$/,
+        callPattern: /\bgetSession\s*\(/gi,
+        description: 'Session helper',
+    },
+    // Supabase patterns
+    {
+        namePattern: /^getUser$/,
+        callPattern: /\bsupabase\.auth\.getUser\s*\(/gi,
+        description: 'Supabase getUser()',
+    },
+];
+/**
+ * Patterns that indicate a function THROWS on missing auth
+ */
+const THROWING_INDICATORS = [
+    /throw\s+new\s+(Error|UnauthorizedError|AuthError|HttpException)/i,
+    /throw\s+.*401/i,
+    /throw\s+.*unauthorized/i,
+    /throw\s+.*unauthenticated/i,
+    /return\s+.*401/i,
+    /NextResponse\.json\s*\([^)]*401/i,
+    /res\.status\s*\(\s*401\s*\)/i,
+    /redirect\s*\(\s*['"`].*login/i,
+];
+/**
+ * Patterns that indicate NON-NULL return type
+ */
+const NON_NULL_RETURN_PATTERNS = [
+    /:\s*Promise<string>/i, // : Promise<string>
+    /:\s*string(?!\s*\|)/i, // : string (not string | null)
+    /:\s*Promise<User>/i, // : Promise<User>
+    /:\s*User(?!\s*\|)/i, // : User (not User | null)
+    /:\s*Promise<\w+>(?!\s*\|)/i, // : Promise<SomeType>
+    /\w+!$/i, // Non-null assertion in return
+];
+// ============================================================================
+// Detection Functions
+// ============================================================================
+/**
+ * Detect auth helper functions in the codebase
+ */
+function detectAuthHelpers(files) {
+    const helpers = [];
+    const detectedNames = new Set();
+    // First pass: find auth helper definitions
+    for (const file of files) {
+        // Skip non-code files
+        if (!/\.(ts|tsx|js|jsx)$/i.test(file.path))
+            continue;
+        // Look for function definitions that look like auth helpers
+        const functionMatches = findAuthHelperDefinitions(file.content, file.path);
+        for (const helper of functionMatches) {
+            if (!detectedNames.has(helper.name)) {
+                detectedNames.add(helper.name);
+                helpers.push(helper);
+            }
+        }
+    }
+    // Add well-known helpers if not already detected
+    for (const pattern of THROWING_AUTH_HELPER_PATTERNS) {
+        const nameMatch = pattern.namePattern.source.replace(/[\^\$\\b]/g, '');
+        if (!detectedNames.has(nameMatch)) {
+            // Check if this pattern is used in any file
+            const isUsed = files.some(f => pattern.callPattern.test(f.content));
+            if (isUsed) {
+                helpers.push({
+                    name: nameMatch,
+                    throwsOnMissing: true, // Assume throwing for well-known patterns
+                    returnsNonNull: true,
+                    callPattern: pattern.callPattern,
+                });
+            }
+        }
+    }
+    // Generate summary
+    const throwingHelpers = helpers.filter(h => h.throwsOnMissing);
+    const summary = generateAuthHelperSummary(helpers);
+    return {
+        helpers,
+        hasThrowingHelpers: throwingHelpers.length > 0,
+        summary,
+    };
+}
+/**
+ * Find auth helper function definitions in a file
+ */
+function findAuthHelperDefinitions(content, filePath) {
+    const helpers = [];
+    const lines = content.split('\n');
+    // Patterns for function definitions
+    const funcDefPatterns = [
+        // async function getCurrentUserId(): Promise<string> { ... throw
+        /(?:export\s+)?(?:async\s+)?function\s+(\w+)\s*\([^)]*\)\s*(?::\s*([^{]+))?\s*\{/gi,
+        // const getCurrentUserId = async (): Promise<string> => { ... throw
+        /(?:export\s+)?const\s+(\w+)\s*=\s*(?:async\s*)?\([^)]*\)\s*(?::\s*([^=]+))?\s*=>/gi,
+    ];
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        for (const pattern of funcDefPatterns) {
+            pattern.lastIndex = 0;
+            const match = pattern.exec(line);
+            if (!match)
+                continue;
+            const funcName = match[1];
+            const returnType = match[2]?.trim();
+            // Check if this looks like an auth helper by name
+            const isAuthHelperName = THROWING_AUTH_HELPER_PATTERNS.some(p => p.namePattern.test(funcName));
+            if (!isAuthHelperName)
+                continue;
+            // Look ahead for throwing patterns and return type
+            const functionBody = extractFunctionBody(lines, i);
+            const throwsOnMissing = THROWING_INDICATORS.some(p => p.test(functionBody));
+            const returnsNonNull = returnType
+                ? NON_NULL_RETURN_PATTERNS.some(p => p.test(`: ${returnType}`))
+                : false;
+            // Create call pattern for this helper
+            const callPattern = new RegExp(`\\b${escapeRegex(funcName)}\\s*\\(`, 'gi');
+            helpers.push({
+                name: funcName,
+                definedIn: filePath,
+                throwsOnMissing,
+                returnType,
+                returnsNonNull: returnsNonNull || throwsOnMissing, // If it throws, the return is non-null
+                callPattern,
+            });
+        }
+    }
+    return helpers;
+}
+/**
+ * Extract function body for analysis (up to closing brace)
+ */
+function extractFunctionBody(lines, startLine, maxLines = 50) {
+    let braceCount = 0;
+    let started = false;
+    const bodyLines = [];
+    for (let i = startLine; i < Math.min(lines.length, startLine + maxLines); i++) {
+        const line = lines[i];
+        bodyLines.push(line);
+        for (const char of line) {
+            if (char === '{') {
+                braceCount++;
+                started = true;
+            }
+            else if (char === '}') {
+                braceCount--;
+                if (started && braceCount === 0) {
+                    return bodyLines.join('\n');
+                }
+            }
+        }
+    }
+    return bodyLines.join('\n');
+}
+/**
+ * Check if a code line uses a throwing auth helper
+ * Returns the helper if found, undefined otherwise
+ */
+function usesThrowingAuthHelper(lineContent, surroundingContent, helpers) {
+    // Check if any throwing helper is called in the surrounding context
+    const throwingHelpers = helpers.filter(h => h.throwsOnMissing);
+    for (const helper of throwingHelpers) {
+        helper.callPattern.lastIndex = 0;
+        if (helper.callPattern.test(surroundingContent)) {
+            return helper;
+        }
+    }
+    return undefined;
+}
+/**
+ * Well-known auth helper call patterns - used as fallback when no helpers are detected
+ * These patterns are common across frameworks and should be recognized even without project analysis
+ */
+const WELL_KNOWN_AUTH_CALL_PATTERNS = [
+    // Generic throwing auth patterns
+    { pattern: /\bgetCurrentUserId\s*\(/i, name: 'getCurrentUserId' },
+    { pattern: /\bgetCurrentUser\s*\(/i, name: 'getCurrentUser' },
+    { pattern: /\brequireAuth\s*\(/i, name: 'requireAuth' },
+    { pattern: /\brequireUser\s*\(/i, name: 'requireUser' },
+    { pattern: /\bensureAuth\s*\(/i, name: 'ensureAuth' },
+    { pattern: /\bensureAuthenticated\s*\(/i, name: 'ensureAuthenticated' },
+    { pattern: /\bverifyAuth\s*\(/i, name: 'verifyAuth' },
+    { pattern: /\bcheckAuth\s*\(/i, name: 'checkAuth' },
+    { pattern: /\bvalidateAuth\s*\(/i, name: 'validateAuth' },
+    { pattern: /\bassertAuth\s*\(/i, name: 'assertAuth' },
+    { pattern: /\bgetAuth\s*\(/i, name: 'getAuth' },
+    { pattern: /\bfetchCurrentUser\s*\(/i, name: 'fetchCurrentUser' },
+    // Clerk
+    { pattern: /\bauth\s*\(\s*\)\.protect\s*\(/i, name: 'auth().protect' },
+    { pattern: /\bcurrentUser\s*\(\s*\)/i, name: 'currentUser' },
+    // NextAuth
+    { pattern: /\bgetServerSession\s*\(/i, name: 'getServerSession' },
+    // Supabase
+    { pattern: /\bsupabase\.auth\.getUser\s*\(/i, name: 'supabase.auth.getUser' },
+    // Destructuring pattern
+    { pattern: /const\s+\{\s*user\s*\}\s*=\s*await\s+auth/i, name: 'destructured auth' },
+];
+/**
+ * Check if a file has auth helper calls before a given line
+ * This indicates the code after the call is in authenticated context
+ */
+function hasAuthHelperCallBefore(content, lineNumber, helpers) {
+    const lines = content.split('\n');
+    const throwingHelpers = helpers.filter(h => h.throwsOnMissing);
+    // Increase search window from 30 to 100 lines for better coverage
+    const searchStart = Math.max(0, lineNumber - 100);
+    // Look backwards from the current line
+    for (let i = lineNumber - 1; i >= searchStart; i--) {
+        const line = lines[i];
+        // Check detected helpers first
+        for (const helper of throwingHelpers) {
+            helper.callPattern.lastIndex = 0;
+            if (helper.callPattern.test(line)) {
+                return { hasCall: true, helper, callLine: i + 1 };
+            }
+        }
+        // Stop at function boundaries (for module-level helpers, we still check inside function)
+        if (/\b(function|async function|=>|export\s+default)\b/.test(line) && /\{/.test(line)) {
+            // If this is the route handler definition line, continue checking inside it
+            if (i !== lineNumber - 1) {
+                break;
+            }
+        }
+    }
+    // FORWARD SEARCH: Always search forward into the function body
+    // This catches auth helpers called INSIDE the route handler, not just before it
+    // Example: export async function GET() { const userId = await getCurrentUserId(); ... }
+    const endLine = Math.min(lines.length, lineNumber + 30);
+    for (let i = lineNumber; i < endLine; i++) {
+        const line = lines[i];
+        // Check detected helpers
+        for (const helper of throwingHelpers) {
+            helper.callPattern.lastIndex = 0;
+            if (helper.callPattern.test(line)) {
+                return { hasCall: true, helper, callLine: i + 1 };
+            }
+        }
+        // Also check well-known patterns (fallback for single-file scans)
+        for (const known of WELL_KNOWN_AUTH_CALL_PATTERNS) {
+            if (known.pattern.test(line)) {
+                return {
+                    hasCall: true,
+                    helper: {
+                        name: known.name,
+                        throwsOnMissing: true,
+                        returnsNonNull: true,
+                        callPattern: known.pattern,
+                    },
+                    callLine: i + 1
+                };
+            }
+        }
+        // Stop at another function boundary (but not the current line)
+        if (i > lineNumber && /\bexport\s+(async\s+)?function\s+(GET|POST|PUT|DELETE|PATCH)\s*\(/i.test(line)) {
+            break;
+        }
+    }
+    return { hasCall: false };
+}
+/**
+ * Generate summary for AI validation
+ */
+function generateAuthHelperSummary(helpers) {
+    if (helpers.length === 0) {
+        return 'No auth helper functions detected.';
+    }
+    const throwing = helpers.filter(h => h.throwsOnMissing);
+    const lines = [];
+    lines.push('### Auth Helper Functions');
+    lines.push('');
+    if (throwing.length > 0) {
+        lines.push('**Throwing auth helpers** (guarantee authenticated context when called):');
+        for (const h of throwing) {
+            const location = h.definedIn ? ` (defined in ${h.definedIn})` : '';
+            lines.push(`- \`${h.name}()\`${location}`);
+        }
+        lines.push('');
+        lines.push('When these helpers are called at the start of a function, subsequent code is GUARANTEED to have an authenticated user. Do NOT flag "missing auth" or suggest `if (!userId)` checks after these calls.');
+    }
+    return lines.join('\n');
+}
+/**
+ * Escape special regex characters
+ */
+function escapeRegex(str) {
+    return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Check if code suggests user ID is already validated
+ * Detects patterns like: const userId = await getCurrentUserId()
+ */
+function isUserIdAlreadyValidated(content, lineNumber, helpers) {
+    const lines = content.split('\n');
+    const contextStart = Math.max(0, lineNumber - 20);
+    const context = lines.slice(contextStart, lineNumber).join('\n');
+    // Check for throwing helper calls
+    const throwingHelpers = helpers.filter(h => h.throwsOnMissing);
+    for (const helper of throwingHelpers) {
+        helper.callPattern.lastIndex = 0;
+        if (helper.callPattern.test(context)) {
+            return true;
+        }
+    }
+    // Check for common validation patterns
+    const validationPatterns = [
+        /const\s+(?:userId|user_id|currentUserId)\s*=\s*await/i,
+        /if\s*\(\s*!(?:userId|user_id|user|session)\s*\)/i, // Already has the check
+        /(?:userId|user_id)\s*\|\|\s*throw/i,
+        /auth\(\)\.protect\(\)/i, // Clerk protect
+    ];
+    return validationPatterns.some(p => p.test(context));
+}
+//# sourceMappingURL=auth-helper-detector.js.map

package/dist/model/auth-helper-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-helper-detector.js","sourceRoot":"","sources":["../../src/model/auth-helper-detector.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AA8GH,8CA6CC;AA2FD,wDAgBC;AAmCD,0DAsEC;AAwCD,4DA2BC;AAlZD,+EAA+E;AAC/E,kCAAkC;AAClC,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,6BAA6B,GAAG;IACpC,mBAAmB;IACnB;QACE,WAAW,EAAE,kFAAkF;QAC/F,WAAW,EAAE,wFAAwF;QACrG,WAAW,EAAE,+CAA+C;KAC7D;IACD,iBAAiB;IACjB;QACE,WAAW,EAAE,QAAQ;QACrB,WAAW,EAAE,oBAAoB;QACjC,WAAW,EAAE,qBAAqB;KACnC;IACD;QACE,WAAW,EAAE,eAAe;QAC5B,WAAW,EAAE,2BAA2B;QACxC,WAAW,EAAE,4BAA4B;KAC1C;IACD,oBAAoB;IACpB;QACE,WAAW,EAAE,oBAAoB;QACjC,WAAW,EAAE,2BAA2B;QACxC,WAAW,EAAE,6BAA6B;KAC3C;IACD;QACE,WAAW,EAAE,cAAc;QAC3B,WAAW,EAAE,qBAAqB;QAClC,WAAW,EAAE,gBAAgB;KAC9B;IACD,oBAAoB;IACpB;QACE,WAAW,EAAE,WAAW;QACxB,WAAW,EAAE,kCAAkC;QAC/C,WAAW,EAAE,oBAAoB;KAClC;CACF,CAAA;AAED;;GAEG;AACH,MAAM,mBAAmB,GAAG;IAC1B,kEAAkE;IAClE,gBAAgB;IAChB,yBAAyB;IACzB,4BAA4B;IAC5B,iBAAiB;IACjB,kCAAkC;IAClC,8BAA8B;IAC9B,+BAA+B;CAChC,CAAA;AAED;;GAEG;AACH,MAAM,wBAAwB,GAAG;IAC/B,sBAAsB,EAAS,oBAAoB;IACnD,sBAAsB,EAAS,+BAA+B;IAC9D,oBAAoB,EAAW,kBAAkB;IACjD,oBAAoB,EAAW,2BAA2B;IAC1D,4BAA4B,EAAG,sBAAsB;IACrD,QAAQ,EAAwB,+BAA+B;CAChE,CAAA;AAED,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E;;GAEG;AACH,SAAgB,iBAAiB,CAAC,KAAiB;IACjD,MAAM,OAAO,GAAiB,EAAE,CAAA;IAChC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAA;IAEvC,2CAA2C;IAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,sBAAsB;QACtB,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAQ;QAEpD,4DAA4D;QAC5D,MAAM,eAAe,GAAG,yBAAyB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC1E,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;YACrC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;gBAC9B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,KAAK,MAAM,OAAO,IAAI,6BAA6B,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;QACtE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,4CAA4C;YAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;YACnE,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,SAAS;oBACf,eAAe,EAAE,IAAI,EAAE,0CAA0C;oBACjE,cAAc,EAAE,IAAI;oBACpB,WAAW,EAAE,OAAO,CAAC,WAAW;iBACjC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,mBAAmB;IACnB,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;IAC9D,MAAM,OAAO,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAA;IAElD,OAAO;QACL,OAAO;QACP,kBAAkB,EAAE,eAAe,CAAC,MAAM,GAAG,CAAC;QAC9C,OAAO;KACR,CAAA;AACH,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAAC,OAAe,EAAE,QAAgB;IAClE,MAAM,OAAO,GAAiB,EAAE,CAAA;IAChC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAEjC,oCAAoC;IACpC,MAAM,eAAe,GAAG;QACtB,iEAAiE;QACjE,mFAAmF;QACnF,oEAAoE;QACpE,oFAAoF;KACrF,CAAA;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QAErB,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;YACtC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAA;YACrB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAChC,IAAI,CAAC,KAAK;gBAAE,SAAQ;YAEpB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;YACzB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;YAEnC,kDAAkD;YAClD,MAAM,gBAAgB,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC9D,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC7B,CAAA;YAED,IAAI,CAAC,gBAAgB;gBAAE,SAAQ;YAE/B,mDAAmD;YACnD,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;YAClD,MAAM,eAAe,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAA;YAC3E,MAAM,cAAc,GAAG,UAAU;gBAC/B,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC,CAAC;gBAC/D,CAAC,CAAC,KAAK,CAAA;YAET,sCAAsC;YACtC,MAAM,WAAW,GAAG,IAAI,MAAM,CAAC,MAAM,WAAW,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;YAE1E,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,SAAS,EAAE,QAAQ;gBACnB,eAAe;gBACf,UAAU;gBACV,cAAc,EAAE,cAAc,IAAI,eAAe,EAAE,uCAAuC;gBAC1F,WAAW;aACZ,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,KAAe,EAAE,SAAiB,EAAE,WAAmB,EAAE;IACpF,IAAI,UAAU,GAAG,CAAC,CAAA;IAClB,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,MAAM,SAAS,GAAa,EAAE,CAAA;IAE9B,KAAK,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9E,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEpB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;YACxB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,UAAU,EAAE,CAAA;gBACZ,OAAO,GAAG,IAAI,CAAA;YAChB,CAAC;iBAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACxB,UAAU,EAAE,CAAA;gBACZ,IAAI,OAAO,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;oBAChC,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC7B,CAAC;AAED;;;GAGG;AACH,SAAgB,sBAAsB,CACpC,WAAmB,EACnB,kBAA0B,EAC1B,OAAqB;IAErB,oEAAoE;IACpE,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;IAE9D,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACrC,MAAM,CAAC,WAAW,CAAC,SAAS,GAAG,CAAC,CAAA;QAChC,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAChD,OAAO,MAAM,CAAA;QACf,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,6BAA6B,GAA6C;IAC9E,iCAAiC;IACjC,EAAE,OAAO,EAAE,0BAA0B,EAAE,IAAI,EAAE,kBAAkB,EAAE;IACjE,EAAE,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE,gBAAgB,EAAE;IAC7D,EAAE,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,aAAa,EAAE;IACvD,EAAE,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,aAAa,EAAE;IACvD,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,YAAY,EAAE;IACrD,EAAE,OAAO,EAAE,6BAA6B,EAAE,IAAI,EAAE,qBAAqB,EAAE;IACvE,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,YAAY,EAAE;IACrD,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,WAAW,EAAE;IACnD,EAAE,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,cAAc,EAAE;IACzD,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,YAAY,EAAE;IACrD,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE;IAC/C,EAAE,OAAO,EAAE,0BAA0B,EAAE,IAAI,EAAE,kBAAkB,EAAE;IACjE,QAAQ;IACR,EAAE,OAAO,EAAE,iCAAiC,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACtE,EAAE,OAAO,EAAE,0BAA0B,EAAE,IAAI,EAAE,aAAa,EAAE;IAC5D,WAAW;IACX,EAAE,OAAO,EAAE,0BAA0B,EAAE,IAAI,EAAE,kBAAkB,EAAE;IACjE,WAAW;IACX,EAAE,OAAO,EAAE,iCAAiC,EAAE,IAAI,EAAE,uBAAuB,EAAE;IAC7E,wBAAwB;IACxB,EAAE,OAAO,EAAE,4CAA4C,EAAE,IAAI,EAAE,mBAAmB,EAAE;CACrF,CAAA;AAED;;;GAGG;AACH,SAAgB,uBAAuB,CACrC,OAAe,EACf,UAAkB,EAClB,OAAqB;IAErB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;IAE9D,kEAAkE;IAClE,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,GAAG,CAAC,CAAA;IAEjD,uCAAuC;IACvC,KAAK,IAAI,CAAC,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QAErB,+BAA+B;QAC/B,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;YACrC,MAAM,CAAC,WAAW,CAAC,SAAS,GAAG,CAAC,CAAA;YAChC,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,CAAA;YACnD,CAAC;QACH,CAAC;QAED,yFAAyF;QACzF,IAAI,mDAAmD,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtF,4EAA4E;YAC5E,IAAI,CAAC,KAAK,UAAU,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,gFAAgF;IAChF,wFAAwF;IACxF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,GAAG,EAAE,CAAC,CAAA;IACvD,KAAK,IAAI,CAAC,GAAG,UAAU,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QAErB,yBAAyB;QACzB,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;YACrC,MAAM,CAAC,WAAW,CAAC,SAAS,GAAG,CAAC,CAAA;YAChC,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,CAAA;YACnD,CAAC;QACH,CAAC;QAED,kEAAkE;QAClE,KAAK,MAAM,KAAK,IAAI,6BAA6B,EAAE,CAAC;YAClD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE;wBACN,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,eAAe,EAAE,IAAI;wBACrB,cAAc,EAAE,IAAI;wBACpB,WAAW,EAAE,KAAK,CAAC,OAAO;qBAC3B;oBACD,QAAQ,EAAE,CAAC,GAAG,CAAC;iBAChB,CAAA;YACH,CAAC;QACH,CAAC;QAED,+DAA+D;QAC/D,IAAI,CAAC,GAAG,UAAU,IAAI,oEAAoE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtG,MAAK;QACP,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;AAC3B,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAAC,OAAqB;IACtD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,oCAAoC,CAAA;IAC7C,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;IACvD,MAAM,KAAK,GAAa,EAAE,CAAA;IAE1B,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;IACvC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEd,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAA;QACtF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;YAClE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,QAAQ,EAAE,CAAC,CAAA;QAC5C,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACd,KAAK,CAAC,IAAI,CAAC,uMAAuM,CAAC,CAAA;IACrN,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;AACnD,CAAC;AAED;;;GAGG;AACH,SAAgB,wBAAwB,CACtC,OAAe,EACf,UAAkB,EAClB,OAAqB;IAErB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,EAAE,CAAC,CAAA;IACjD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEhE,kCAAkC;IAClC,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;IAC9D,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACrC,MAAM,CAAC,WAAW,CAAC,SAAS,GAAG,CAAC,CAAA;QAChC,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,MAAM,kBAAkB,GAAG;QACzB,uDAAuD;QACvD,kDAAkD,EAAE,wBAAwB;QAC5E,oCAAoC;QACpC,wBAAwB,EAAE,gBAAgB;KAC3C,CAAA;IAED,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;AACtD,CAAC"}

package/dist/model/cross-file-taint.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Cross-File Taint Analysis — Detects taint flows that cross file boundaries.
+ *
+ * Scenario 1: Source in file A, sink in imported function (file B).
+ *   File A has req.params.id (tainted), calls getUser(id) imported from B.
+ *   B's getUser has param 'id' reaching a sql_query sink.
+ *
+ * Scenario 2: Imported function returns user data.
+ *   File A calls getUserInput() from B which returns req.body.
+ *   File A then passes the return value to a local sink.
+ *
+ * Constraint: One level of imports only. No transitive chasing (A->B->C).
+ */
+import type { ScanFile } from '../shared/types';
+import type { ModuleGraph } from './module-graph';
+import type { FunctionProfileMap } from './function-classifier';
+import type { FileTaintAnalysis, UserInputSource, TaintSink } from './taint-types';
+export interface CrossFileTaintPath {
+    sourceFile: string;
+    source: UserInputSource;
+    sinkFile: string;
+    sink: TaintSink;
+    importLink: {
+        fromFile: string;
+        toFile: string;
+        symbolName: string;
+        paramName?: string;
+        callLine: number;
+    };
+    sanitised: boolean;
+    confidence: 'high' | 'medium' | 'low';
+}
+/**
+ * Analyze cross-file taint paths across the project.
+ *
+ * For each file with taint sources, check if tainted variables flow into
+ * calls to imported functions that reach dangerous sinks.
+ */
+export declare function analyzeCrossFileTaint(files: ScanFile[], graph: ModuleGraph, functionProfiles: FunctionProfileMap, fileTaintAnalyses: Map<string, FileTaintAnalysis>): CrossFileTaintPath[];
+//# sourceMappingURL=cross-file-taint.d.ts.map

package/dist/model/cross-file-taint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cross-file-taint.d.ts","sourceRoot":"","sources":["../../src/model/cross-file-taint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AACjD,OAAO,KAAK,EAAE,kBAAkB,EAA2B,MAAM,uBAAuB,CAAA;AACxF,OAAO,KAAK,EACV,iBAAiB,EACjB,eAAe,EACf,SAAS,EAEV,MAAM,eAAe,CAAA;AAOtB,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,eAAe,CAAA;IACvB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,SAAS,CAAA;IACf,UAAU,EAAE;QACV,QAAQ,EAAE,MAAM,CAAA;QAChB,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,MAAM,CAAA;QAClB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,QAAQ,EAAE,MAAM,CAAA;KACjB,CAAA;IACD,SAAS,EAAE,OAAO,CAAA;IAClB,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;CACtC;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,QAAQ,EAAE,EACjB,KAAK,EAAE,WAAW,EAClB,gBAAgB,EAAE,kBAAkB,EACpC,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAChD,kBAAkB,EAAE,CAwCtB"}