@oculum/scanner 1.0.11 → 1.0.13

package/dist/model/oauth-flow-detector.d.ts

@@ -0,0 +1,41 @@
+/**
+ * OAuth Flow Detector
+ * Detects OAuth state generation and validation across multiple files
+ * to prevent false positives when state is implemented correctly but split across files.
+ */
+import type { ScanFile } from '../shared/types';
+export interface OAuthFlowContext {
+    /** Whether state generation is detected in any file */
+    hasStateGeneration: boolean;
+    /** File where state is generated */
+    stateGenerationFile?: string;
+    /** Line number where state is generated */
+    stateGenerationLine?: number;
+    /** Whether state validation is detected in any file */
+    hasStateValidation: boolean;
+    /** File where state is validated */
+    stateValidationFile?: string;
+    /** Line number where state is validated */
+    stateValidationLine?: number;
+    /** Whether PKCE code_verifier is used */
+    hasCodeVerifier: boolean;
+    /** File where code_verifier is generated */
+    codeVerifierFile?: string;
+    /** Detected OAuth flow type */
+    flowType: 'authorization_code' | 'client_credentials' | 'implicit' | 'pkce' | 'unknown';
+    /** OAuth providers detected */
+    providers: string[];
+}
+/**
+ * Detect OAuth flow patterns across multiple files
+ */
+export declare function detectOAuthFlow(files: ScanFile[]): OAuthFlowContext;
+/**
+ * Check if OAuth state is properly implemented across files
+ */
+export declare function isOAuthStateImplemented(context: OAuthFlowContext): boolean;
+/**
+ * Get a summary of the OAuth flow for logging/context
+ */
+export declare function getOAuthFlowSummary(context: OAuthFlowContext): string;
+//# sourceMappingURL=oauth-flow-detector.d.ts.map

package/dist/model/oauth-flow-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-flow-detector.d.ts","sourceRoot":"","sources":["../../src/model/oauth-flow-detector.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAE/C,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,kBAAkB,EAAE,OAAO,CAAA;IAC3B,oCAAoC;IACpC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,2CAA2C;IAC3C,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,uDAAuD;IACvD,kBAAkB,EAAE,OAAO,CAAA;IAC3B,oCAAoC;IACpC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,2CAA2C;IAC3C,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,yCAAyC;IACzC,eAAe,EAAE,OAAO,CAAA;IACxB,4CAA4C;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,+BAA+B;IAC/B,QAAQ,EAAE,oBAAoB,GAAG,oBAAoB,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,CAAA;IACvF,+BAA+B;IAC/B,SAAS,EAAE,MAAM,EAAE,CAAA;CACpB;AAoFD;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CA4EnE;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAa1E;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CA8BrE"}

package/dist/model/oauth-flow-detector.js

@@ -0,0 +1,202 @@
+"use strict";
+/**
+ * OAuth Flow Detector
+ * Detects OAuth state generation and validation across multiple files
+ * to prevent false positives when state is implemented correctly but split across files.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectOAuthFlow = detectOAuthFlow;
+exports.isOAuthStateImplemented = isOAuthStateImplemented;
+exports.getOAuthFlowSummary = getOAuthFlowSummary;
+/**
+ * Patterns that indicate OAuth state generation
+ */
+const STATE_GENERATION_PATTERNS = [
+    /generateState\s*\(/i,
+    /crypto\.randomBytes.*state/i,
+    /state\s*=\s*.*random/i,
+    /setCookie.*oauth.*state/i,
+    /cookies?\(\s*\)\.set\s*\([^)]*state/i,
+    /state\s*=\s*generateRandomString/i,
+    /state\s*=\s*nanoid\s*\(/i,
+    /state\s*=\s*uuid/i,
+    /state\s*=\s*crypto\.randomUUID/i,
+    /createState\s*\(/i,
+    /oauth.*state.*=.*crypto/i,
+    /\.setState\s*\(/i,
+    /stateParam\s*=\s*/i,
+    /generateOAuthState/i,
+];
+/**
+ * Patterns that indicate OAuth state validation
+ */
+const STATE_VALIDATION_PATTERNS = [
+    /state\s*!==\s*storedState/i,
+    /storedState.*!==.*state/i,
+    /validateState\s*\(/i,
+    /getCookie.*oauth.*state/i,
+    /cookies?\(\s*\)\.get\s*\([^)]*state/i,
+    /verifyState\s*\(/i,
+    /checkState\s*\(/i,
+    /state\s*===\s*savedState/i,
+    /savedState\s*===\s*state/i,
+    /if\s*\(\s*!?\s*state\s*\)/i,
+    /state\s*!==\s*.*\.get\s*\(/i,
+    /\.getState\s*\(/i,
+    /compareState\s*\(/i,
+];
+/**
+ * Patterns that indicate PKCE code_verifier usage
+ */
+const CODE_VERIFIER_PATTERNS = [
+    /code_verifier/i,
+    /codeVerifier/i,
+    /generateCodeVerifier/i,
+    /createCodeVerifier/i,
+    /pkce/i,
+    /code_challenge/i,
+    /codeChallenge/i,
+];
+/**
+ * Patterns that indicate client_credentials flow (no state needed)
+ */
+const CLIENT_CREDENTIALS_PATTERNS = [
+    /grant_type.*client_credentials/i,
+    /client_credentials.*grant/i,
+    /\.clientCredentials\s*\(/i,
+    /getClientCredentialsToken/i,
+    /machine-to-machine/i,
+    /m2m.*auth/i,
+];
+/**
+ * Known OAuth provider patterns
+ */
+const OAUTH_PROVIDER_PATTERNS = {
+    google: [/googleapis\.com\/oauth/i, /accounts\.google\.com/i, /google.*oauth/i],
+    github: [/github\.com\/login\/oauth/i, /api\.github\.com.*oauth/i],
+    microsoft: [/login\.microsoftonline\.com/i, /microsoft.*oauth/i, /azure.*oauth/i],
+    facebook: [/facebook\.com\/.*oauth/i, /graph\.facebook\.com/i],
+    twitter: [/twitter\.com\/oauth/i, /api\.twitter\.com.*oauth/i],
+    apple: [/appleid\.apple\.com/i, /apple.*oauth/i],
+    auth0: [/auth0\.com/i, /\.auth0\./i],
+    okta: [/okta\.com/i, /\.okta\./i],
+    clerk: [/clerk\.dev/i, /clerk\.com/i, /@clerk\//i],
+    nextauth: [/next-auth/i, /nextauth/i, /authjs/i],
+    lucia: [/lucia-auth/i, /lucia\.ts/i],
+    arctic: [/arctic/i, /oslo\/oauth/i],
+};
+/**
+ * Detect OAuth flow patterns across multiple files
+ */
+function detectOAuthFlow(files) {
+    const context = {
+        hasStateGeneration: false,
+        hasStateValidation: false,
+        hasCodeVerifier: false,
+        flowType: 'unknown',
+        providers: [],
+    };
+    const detectedProviders = new Set();
+    for (const file of files) {
+        const content = file.content;
+        const lines = content.split('\n');
+        // Check for state generation
+        if (!context.hasStateGeneration) {
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                if (STATE_GENERATION_PATTERNS.some(p => p.test(line))) {
+                    context.hasStateGeneration = true;
+                    context.stateGenerationFile = file.path;
+                    context.stateGenerationLine = i + 1;
+                    break;
+                }
+            }
+        }
+        // Check for state validation
+        if (!context.hasStateValidation) {
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                if (STATE_VALIDATION_PATTERNS.some(p => p.test(line))) {
+                    context.hasStateValidation = true;
+                    context.stateValidationFile = file.path;
+                    context.stateValidationLine = i + 1;
+                    break;
+                }
+            }
+        }
+        // Check for PKCE
+        if (!context.hasCodeVerifier) {
+            if (CODE_VERIFIER_PATTERNS.some(p => p.test(content))) {
+                context.hasCodeVerifier = true;
+                context.codeVerifierFile = file.path;
+            }
+        }
+        // Check for client_credentials flow
+        if (context.flowType === 'unknown') {
+            if (CLIENT_CREDENTIALS_PATTERNS.some(p => p.test(content))) {
+                context.flowType = 'client_credentials';
+            }
+        }
+        // Detect OAuth providers
+        for (const [provider, patterns] of Object.entries(OAUTH_PROVIDER_PATTERNS)) {
+            if (patterns.some(p => p.test(content))) {
+                detectedProviders.add(provider);
+            }
+        }
+    }
+    // Determine flow type
+    if (context.flowType === 'unknown') {
+        if (context.hasCodeVerifier) {
+            context.flowType = 'pkce';
+        }
+        else if (context.hasStateGeneration || context.hasStateValidation) {
+            context.flowType = 'authorization_code';
+        }
+    }
+    context.providers = Array.from(detectedProviders);
+    return context;
+}
+/**
+ * Check if OAuth state is properly implemented across files
+ */
+function isOAuthStateImplemented(context) {
+    // client_credentials flow doesn't need state
+    if (context.flowType === 'client_credentials') {
+        return true;
+    }
+    // PKCE flow with code_verifier is secure even without traditional state
+    if (context.hasCodeVerifier) {
+        return true;
+    }
+    // Both generation and validation must be present
+    return context.hasStateGeneration && context.hasStateValidation;
+}
+/**
+ * Get a summary of the OAuth flow for logging/context
+ */
+function getOAuthFlowSummary(context) {
+    const parts = [];
+    if (context.flowType !== 'unknown') {
+        parts.push(`Flow: ${context.flowType}`);
+    }
+    if (context.providers.length > 0) {
+        parts.push(`Providers: ${context.providers.join(', ')}`);
+    }
+    if (context.hasStateGeneration) {
+        parts.push(`State generated in: ${context.stateGenerationFile}`);
+    }
+    if (context.hasStateValidation) {
+        parts.push(`State validated in: ${context.stateValidationFile}`);
+    }
+    if (context.hasCodeVerifier) {
+        parts.push(`PKCE enabled (${context.codeVerifierFile})`);
+    }
+    if (isOAuthStateImplemented(context)) {
+        parts.push('✓ OAuth state properly implemented');
+    }
+    else if (context.hasStateGeneration || context.hasStateValidation) {
+        parts.push('⚠ Partial OAuth state implementation detected');
+    }
+    return parts.join('; ');
+}
+//# sourceMappingURL=oauth-flow-detector.js.map

package/dist/model/oauth-flow-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-flow-detector.js","sourceRoot":"","sources":["../../src/model/oauth-flow-detector.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAgHH,0CA4EC;AAKD,0DAaC;AAKD,kDA8BC;AAtND;;GAEG;AACH,MAAM,yBAAyB,GAAG;IAChC,qBAAqB;IACrB,6BAA6B;IAC7B,uBAAuB;IACvB,0BAA0B;IAC1B,sCAAsC;IACtC,mCAAmC;IACnC,0BAA0B;IAC1B,mBAAmB;IACnB,iCAAiC;IACjC,mBAAmB;IACnB,0BAA0B;IAC1B,kBAAkB;IAClB,oBAAoB;IACpB,qBAAqB;CACtB,CAAA;AAED;;GAEG;AACH,MAAM,yBAAyB,GAAG;IAChC,4BAA4B;IAC5B,0BAA0B;IAC1B,qBAAqB;IACrB,0BAA0B;IAC1B,sCAAsC;IACtC,mBAAmB;IACnB,kBAAkB;IAClB,2BAA2B;IAC3B,2BAA2B;IAC3B,4BAA4B;IAC5B,6BAA6B;IAC7B,kBAAkB;IAClB,oBAAoB;CACrB,CAAA;AAED;;GAEG;AACH,MAAM,sBAAsB,GAAG;IAC7B,gBAAgB;IAChB,eAAe;IACf,uBAAuB;IACvB,qBAAqB;IACrB,OAAO;IACP,iBAAiB;IACjB,gBAAgB;CACjB,CAAA;AAED;;GAEG;AACH,MAAM,2BAA2B,GAAG;IAClC,iCAAiC;IACjC,4BAA4B;IAC5B,2BAA2B;IAC3B,4BAA4B;IAC5B,qBAAqB;IACrB,YAAY;CACb,CAAA;AAED;;GAEG;AACH,MAAM,uBAAuB,GAA6B;IACxD,MAAM,EAAE,CAAC,yBAAyB,EAAE,wBAAwB,EAAE,gBAAgB,CAAC;IAC/E,MAAM,EAAE,CAAC,4BAA4B,EAAE,0BAA0B,CAAC;IAClE,SAAS,EAAE,CAAC,8BAA8B,EAAE,mBAAmB,EAAE,eAAe,CAAC;IACjF,QAAQ,EAAE,CAAC,yBAAyB,EAAE,uBAAuB,CAAC;IAC9D,OAAO,EAAE,CAAC,sBAAsB,EAAE,2BAA2B,CAAC;IAC9D,KAAK,EAAE,CAAC,sBAAsB,EAAE,eAAe,CAAC;IAChD,KAAK,EAAE,CAAC,aAAa,EAAE,YAAY,CAAC;IACpC,IAAI,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC;IACjC,KAAK,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,WAAW,CAAC;IAClD,QAAQ,EAAE,CAAC,YAAY,EAAE,WAAW,EAAE,SAAS,CAAC;IAChD,KAAK,EAAE,CAAC,aAAa,EAAE,YAAY,CAAC;IACpC,MAAM,EAAE,CAAC,SAAS,EAAE,cAAc,CAAC;CACpC,CAAA;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,KAAiB;IAC/C,MAAM,OAAO,GAAqB;QAChC,kBAAkB,EAAE,KAAK;QACzB,kBAAkB,EAAE,KAAK;QACzB,eAAe,EAAE,KAAK;QACtB,QAAQ,EAAE,SAAS;QACnB,SAAS,EAAE,EAAE;KACd,CAAA;IAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAA;IAE3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAEjC,6BAA6B;QAC7B,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;gBACrB,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;oBACtD,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAA;oBACjC,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAA;oBACvC,OAAO,CAAC,mBAAmB,GAAG,CAAC,GAAG,CAAC,CAAA;oBACnC,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;gBACrB,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;oBACtD,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAA;oBACjC,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAA;oBACvC,OAAO,CAAC,mBAAmB,GAAG,CAAC,GAAG,CAAC,CAAA;oBACnC,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;QAED,iBAAiB;QACjB,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YAC7B,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBACtD,OAAO,CAAC,eAAe,GAAG,IAAI,CAAA;gBAC9B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAA;YACtC,CAAC;QACH,CAAC;QAED,oCAAoC;QACpC,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnC,IAAI,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC3D,OAAO,CAAC,QAAQ,GAAG,oBAAoB,CAAA;YACzC,CAAC;QACH,CAAC;QAED,yBAAyB;QACzB,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAC3E,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBACxC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAA;QAC3B,CAAC;aAAM,IAAI,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;YACpE,OAAO,CAAC,QAAQ,GAAG,oBAAoB,CAAA;QACzC,CAAC;IACH,CAAC;IAED,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAEjD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;GAEG;AACH,SAAgB,uBAAuB,CAAC,OAAyB;IAC/D,6CAA6C;IAC7C,IAAI,OAAO,CAAC,QAAQ,KAAK,oBAAoB,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAA;IACb,CAAC;IAED,wEAAwE;IACxE,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,iDAAiD;IACjD,OAAO,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAC,kBAAkB,CAAA;AACjE,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAAC,OAAyB;IAC3D,MAAM,KAAK,GAAa,EAAE,CAAA;IAE1B,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,SAAS,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;IACzC,CAAC;IAED,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,cAAc,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,uBAAuB,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAA;IAClE,CAAC;IAED,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,uBAAuB,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAA;IAClE,CAAC;IAED,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,iBAAiB,OAAO,CAAC,gBAAgB,GAAG,CAAC,CAAA;IAC1D,CAAC;IAED,IAAI,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAA;IAClD,CAAC;SAAM,IAAI,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QACpE,KAAK,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAA;IAC7D,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC"}

package/dist/model/project-context.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Project Context Builder
+ *
+ * Builds a generic project context summary for AI validation by analyzing
+ * common patterns across the codebase. This context helps the AI validator
+ * understand the project's security architecture without hardcoding any
+ * specific framework or vendor.
+ *
+ * Key areas analyzed:
+ * - Authentication & access control patterns
+ * - Data access patterns (ORMs, query builders, raw queries)
+ * - Secrets & configuration handling
+ * - Framework detection
+ */
+import type { ScanFile } from '../shared/types';
+import { type AuthHelperContext, type AuthHelper } from './auth-helper-detector';
+import { type OAuthFlowContext } from './oauth-flow-detector';
+import { type TRPCRouterContext } from './trpc-analyzer';
+export interface ProjectContext {
+    /** Summary string for AI prompt injection */
+    summary: string;
+    /** Authentication & access control patterns */
+    auth: AuthContext;
+    /** Data access patterns */
+    dataAccess: DataAccessContext;
+    /** Secrets & configuration patterns */
+    secrets: SecretsContext;
+    /** Detected frameworks and libraries */
+    frameworks: FrameworkContext;
+    /** File structure insights */
+    structure: StructureContext;
+    /** OAuth flow context */
+    oauth: OAuthFlowContext;
+    /** tRPC router context */
+    trpc: TRPCRouterContext;
+}
+export interface AuthContext {
+    /** Whether global auth middleware is detected */
+    hasGlobalMiddleware: boolean;
+    /** Type of auth provider (clerk, nextauth, auth0, custom, unknown) */
+    authProvider?: string;
+    /** Middleware file path */
+    middlewareFile?: string;
+    /** Protected path patterns */
+    protectedPaths: string[];
+    /** Public/excluded path patterns */
+    publicPaths: string[];
+    /** Auth helper functions detected (names only) */
+    authHelpers: string[];
+    /** Full auth helper context with throwing/return info */
+    authHelperContext?: AuthHelperContext;
+    /** Throwing auth helpers that guarantee authenticated context */
+    throwingAuthHelpers: AuthHelper[];
+    /** Whether user scoping is used in queries */
+    hasUserScoping: boolean;
+    /** User scoping patterns found */
+    userScopingPatterns: string[];
+}
+export interface DataAccessContext {
+    /** ORM/query builder detected */
+    orm?: 'prisma' | 'drizzle' | 'supabase' | 'mongoose' | 'sequelize' | 'typeorm' | 'knex' | 'raw_sql' | 'unknown';
+    /** Whether parameterized queries are the default */
+    usesParameterizedQueries: boolean;
+    /** Database type if detectable */
+    databaseType?: 'postgres' | 'mysql' | 'mongodb' | 'sqlite' | 'unknown';
+    /** Whether RLS (Row Level Security) is mentioned */
+    hasRLS: boolean;
+    /** Data validation library detected */
+    validationLibrary?: string;
+}
+export interface SecretsContext {
+    /** Uses environment variables for secrets */
+    usesEnvVars: boolean;
+    /** Uses a secret manager */
+    usesSecretManager: boolean;
+    /** Secret manager type if detected */
+    secretManagerType?: string;
+    /** Has .env files */
+    hasEnvFiles: boolean;
+    /** Uses NEXT_PUBLIC_ pattern (client-exposed) */
+    hasClientExposedEnvVars: boolean;
+}
+export interface FrameworkContext {
+    /** Primary framework */
+    primary?: 'nextjs' | 'express' | 'fastify' | 'nestjs' | 'django' | 'flask' | 'rails' | 'unknown';
+    /** Frontend framework */
+    frontend?: 'react' | 'vue' | 'svelte' | 'angular' | 'unknown';
+    /** Is this a monorepo? */
+    isMonorepo: boolean;
+    /** Uses TypeScript */
+    usesTypeScript: boolean;
+    /** Uses server components (Next.js 13+) */
+    usesServerComponents: boolean;
+    /** Uses server actions */
+    usesServerActions: boolean;
+}
+export interface StructureContext {
+    /** Has API routes */
+    hasApiRoutes: boolean;
+    /** Has middleware */
+    hasMiddleware: boolean;
+    /** Has server actions */
+    hasServerActions: boolean;
+    /** Total files analyzed */
+    totalFiles: number;
+    /** File types breakdown */
+    fileTypes: Record<string, number>;
+}
+/**
+ * Build a comprehensive project context from scanned files
+ * This context is used to inform AI validation decisions
+ */
+export declare function buildProjectContext(files: ScanFile[]): ProjectContext;
+/**
+ * Generate a compact context string for a single file validation
+ * Used when validating findings in a specific file
+ */
+export declare function getFileValidationContext(file: ScanFile, projectContext: ProjectContext): string;
+//# sourceMappingURL=project-context.d.ts.map

package/dist/model/project-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-context.d.ts","sourceRoot":"","sources":["../../src/model/project-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAE/C,OAAO,EAAqB,KAAK,iBAAiB,EAAE,KAAK,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACnG,OAAO,EAAiE,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC5H,OAAO,EAAsC,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAM5F,MAAM,WAAW,cAAc;IAC7B,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAA;IAEf,+CAA+C;IAC/C,IAAI,EAAE,WAAW,CAAA;IAEjB,2BAA2B;IAC3B,UAAU,EAAE,iBAAiB,CAAA;IAE7B,uCAAuC;IACvC,OAAO,EAAE,cAAc,CAAA;IAEvB,wCAAwC;IACxC,UAAU,EAAE,gBAAgB,CAAA;IAE5B,8BAA8B;IAC9B,SAAS,EAAE,gBAAgB,CAAA;IAE3B,yBAAyB;IACzB,KAAK,EAAE,gBAAgB,CAAA;IAEvB,0BAA0B;IAC1B,IAAI,EAAE,iBAAiB,CAAA;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,iDAAiD;IACjD,mBAAmB,EAAE,OAAO,CAAA;IAC5B,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,2BAA2B;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,8BAA8B;IAC9B,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,oCAAoC;IACpC,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,kDAAkD;IAClD,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,yDAAyD;IACzD,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC,iEAAiE;IACjE,mBAAmB,EAAE,UAAU,EAAE,CAAA;IACjC,8CAA8C;IAC9C,cAAc,EAAE,OAAO,CAAA;IACvB,kCAAkC;IAClC,mBAAmB,EAAE,MAAM,EAAE,CAAA;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,iCAAiC;IACjC,GAAG,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,CAAA;IAC/G,oDAAoD;IACpD,wBAAwB,EAAE,OAAO,CAAA;IACjC,kCAAkC;IAClC,YAAY,CAAC,EAAE,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAA;IACtE,oDAAoD;IACpD,MAAM,EAAE,OAAO,CAAA;IACf,uCAAuC;IACvC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,6CAA6C;IAC7C,WAAW,EAAE,OAAO,CAAA;IACpB,4BAA4B;IAC5B,iBAAiB,EAAE,OAAO,CAAA;IAC1B,sCAAsC;IACtC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,qBAAqB;IACrB,WAAW,EAAE,OAAO,CAAA;IACpB,iDAAiD;IACjD,uBAAuB,EAAE,OAAO,CAAA;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,wBAAwB;IACxB,OAAO,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAA;IAChG,yBAAyB;IACzB,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAA;IAC7D,0BAA0B;IAC1B,UAAU,EAAE,OAAO,CAAA;IACnB,sBAAsB;IACtB,cAAc,EAAE,OAAO,CAAA;IACvB,2CAA2C;IAC3C,oBAAoB,EAAE,OAAO,CAAA;IAC7B,0BAA0B;IAC1B,iBAAiB,EAAE,OAAO,CAAA;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,qBAAqB;IACrB,YAAY,EAAE,OAAO,CAAA;IACrB,qBAAqB;IACrB,aAAa,EAAE,OAAO,CAAA;IACtB,yBAAyB;IACzB,gBAAgB,EAAE,OAAO,CAAA;IACzB,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAClC;AAgDD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,cAAc,CAkCrE;AA4cD;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,QAAQ,EACd,cAAc,EAAE,cAAc,GAC7B,MAAM,CA2BR"}