@opensip-cli/checks-universal 0.1.0

package/dist/checks/security/api-key-rotation.js

@@ -0,0 +1,186 @@
+// @fitness-ignore-file duplicate-implementation-detection -- similar patterns across diagnostic modules
+// @fitness-ignore-file no-todo-comments -- JSDoc uses XXX as a placeholder token in example env-var names
+/**
+ * @fileoverview Validate API key handling supports rotation
+ */
+import { logger } from '@opensip-cli/core';
+import { defineCheck } from '@opensip-cli/fitness';
+import { stripStringLiterals, stripStringsAndComments } from '@opensip-cli/fitness';
+/**
+ * Checks if text contains a single API key equality comparison
+ * Pattern: === or !== followed by process.env.API_KEY (without rotation suffixes)
+ */
+function matchesSingleKeyEquality(text) {
+    logger.debug({
+        evt: 'fitness.checks.api_key_rotation.match_single_key_equality',
+        msg: 'Checking for single key equality comparison',
+    });
+    // Match comparison operators followed by process.env key access
+    // Exclude keys with rotation suffixes (CURRENT, PREVIOUS, PRIMARY, SECONDARY)
+    const match = /(?:===|!==|==|!=)\s*process\.env\.(API_?KEY|SECRET_?KEY|AUTH_?KEY)(\w*)/i.exec(text);
+    if (!match)
+        return null;
+    const suffix = match[2] ?? '';
+    const rotationSuffixes = ['CURRENT', 'PREVIOUS', 'PRIMARY', 'SECONDARY'];
+    if (rotationSuffixes.some((s) => suffix.toUpperCase().includes(s))) {
+        return null;
+    }
+    return match;
+}
+/**
+ * Checks if text contains a single API key assignment
+ * Pattern: const API_KEY = process.env.SOMETHING (not followed by function call)
+ */
+function matchesSingleKeyAssignment(text) {
+    logger.debug({
+        evt: 'fitness.checks.api_key_rotation.match_single_key_assignment',
+        msg: 'Checking for single key assignment pattern',
+    });
+    // Match const declaration with API key name
+    const match = /const\s+(API_?KEY|SECRET_?KEY|AUTH_?KEY)\s*=\s*process\.env\.(\w+)/i.exec(text);
+    if (!match)
+        return null;
+    // Check if followed by function call (indicates wrapped/processed key)
+    const matchIndex = match.index;
+    const afterMatch = text.slice(matchIndex + match[0].length);
+    if (/^\s*\(/.test(afterMatch)) {
+        return null;
+    }
+    return match;
+}
+// Patterns that indicate single-key validation (no rotation support)
+const SINGLE_KEY_PATTERNS = [
+    // Direct equality check with single env var
+    {
+        match: matchesSingleKeyEquality,
+        message: 'Single API key validation detected - consider supporting key rotation with current/previous keys',
+        suggestion: 'Store multiple API keys (current + previous) in environment variables and validate against both during rotation periods. Use API_KEY_CURRENT and API_KEY_PREVIOUS pattern.',
+        severity: 'warning',
+    },
+    // Single key assignment (not array)
+    {
+        match: matchesSingleKeyAssignment,
+        message: 'Single API key configuration - consider supporting multiple keys for rotation',
+        suggestion: 'Load keys as an array: const VALID_KEYS = [process.env.API_KEY_CURRENT, process.env.API_KEY_PREVIOUS].filter(Boolean). Then use validKeys.includes(providedKey) for validation.',
+        severity: 'warning',
+    },
+];
+// Keywords that indicate rotation support is already implemented
+const ROTATION_SUPPORT_KEYWORDS = [
+    'api_key_current',
+    'api_key_previous',
+    'api_key_primary',
+    'api_key_secondary',
+    'apikey_current',
+    'apikey_previous',
+    'apikey_primary',
+    'apikey_secondary',
+    'validkeys.includes',
+    'keys.some',
+    'keys.find',
+];
+/**
+ * Check if content already has rotation support indicators
+ */
+function hasRotationSupport(content) {
+    logger.debug({
+        evt: 'fitness.checks.api_key_rotation.has_rotation_support',
+        msg: 'Checking if content has rotation support indicators',
+    });
+    const lowerContent = content.toLowerCase();
+    return ROTATION_SUPPORT_KEYWORDS.some((kw) => lowerContent.includes(kw));
+}
+/**
+ * Check if content contains API key related references
+ */
+function containsApiKeyReferences(content) {
+    logger.debug({
+        evt: 'fitness.checks.api_key_rotation.contains_api_key_references',
+        msg: 'Checking if content contains API key references',
+    });
+    const stripped = stripStringsAndComments(content).toLowerCase();
+    const hasApiKeyTerms = stripped.includes('api_key') || stripped.includes('apikey') || stripped.includes('api-key');
+    const hasSecretKeyTerms = stripped.includes('secret_key') ||
+        stripped.includes('secretkey') ||
+        stripped.includes('secret-key');
+    const hasAuthKeyTerms = stripped.includes('auth_key') || stripped.includes('authkey') || stripped.includes('auth-key');
+    return hasApiKeyTerms || hasSecretKeyTerms || hasAuthKeyTerms;
+}
+/**
+ * Determine if a file should be processed for API key rotation checks
+ */
+function shouldProcessFile(filePath, content) {
+    logger.debug({
+        evt: 'fitness.checks.api_key_rotation.should_process_file',
+        msg: 'Determining if file should be processed for API key rotation checks',
+    });
+    // Only check files that deal with API keys
+    if (!containsApiKeyReferences(content)) {
+        return false;
+    }
+    // Skip if file already has rotation patterns
+    if (hasRotationSupport(content)) {
+        return false;
+    }
+    return true;
+}
+/**
+ * Check: security/api-key-rotation
+ *
+ * Validates that API key handling supports key rotation.
+ */
+export const apiKeyRotation = defineCheck({
+    id: '32f69a85-7a07-4f60-88dd-cc4a0982c1b4',
+    slug: 'api-key-rotation',
+    scope: { languages: ['typescript'], concerns: ['backend', 'server'] },
+    contentFilter: 'strip-strings',
+    confidence: 'medium',
+    description: 'Validate API key handling supports rotation',
+    longDescription: `**Purpose:** Ensures API key validation logic supports key rotation rather than relying on a single static key.
+
+**Detects:**
+- Single-key equality comparisons: \`=== process.env.API_KEY\` / \`SECRET_KEY\` / \`AUTH_KEY\` without rotation suffixes (CURRENT/PREVIOUS/PRIMARY/SECONDARY)
+- Single-key assignments: \`const API_KEY = process.env.SOMETHING\` not followed by a processing function call
+
+**Why it matters:** Without rotation support, key changes cause downtime because old keys stop working immediately. Supporting current + previous keys allows zero-downtime rotation.
+
+**Scope:** General best practice. Analyzes each file individually.`,
+    tags: ['security', 'api-keys', 'rotation'],
+    fileTypes: ['ts'],
+    analyze(content, filePath) {
+        logger.debug({
+            evt: 'fitness.checks.api_key_rotation.analyze',
+            msg: 'Analyzing file for API key rotation support',
+        });
+        if (!shouldProcessFile(filePath, content)) {
+            return [];
+        }
+        const violations = [];
+        const lines = content.split('\n');
+        for (const [lineNum, line_] of lines.entries()) {
+            const line = line_ ?? '';
+            // Skip comments
+            const trimmed = line.trim();
+            if (trimmed.startsWith('//') || trimmed.startsWith('*')) {
+                continue;
+            }
+            const strippedLine = stripStringLiterals(line);
+            for (const pattern of SINGLE_KEY_PATTERNS) {
+                const match = pattern.match(strippedLine);
+                if (match) {
+                    violations.push({
+                        line: lineNum + 1,
+                        column: match.index,
+                        message: pattern.message,
+                        severity: pattern.severity,
+                        suggestion: pattern.suggestion,
+                        match: match[0],
+                        filePath,
+                    });
+                }
+            }
+        }
+        return violations;
+    },
+});
+//# sourceMappingURL=api-key-rotation.js.map

package/dist/checks/security/api-key-rotation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-rotation.js","sourceRoot":"","sources":["../../../src/checks/security/api-key-rotation.ts"],"names":[],"mappings":"AAAA,wGAAwG;AACxG,0GAA0G;AAC1G;;GAEG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAuB,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAEpF;;;GAGG;AACH,SAAS,wBAAwB,CAAC,IAAY;IAC5C,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,2DAA2D;QAChE,GAAG,EAAE,6CAA6C;KACnD,CAAC,CAAC;IACH,gEAAgE;IAChE,8EAA8E;IAC9E,MAAM,KAAK,GAAG,0EAA0E,CAAC,IAAI,CAC3F,IAAI,CACL,CAAC;IACF,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9B,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IACzE,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,0BAA0B,CAAC,IAAY;IAC9C,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,6DAA6D;QAClE,GAAG,EAAE,4CAA4C;KAClD,CAAC,CAAC;IACH,4CAA4C;IAC5C,MAAM,KAAK,GAAG,qEAAqE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/F,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,uEAAuE;IACvE,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC;IAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qEAAqE;AACrE,MAAM,mBAAmB,GAAG;IAC1B,4CAA4C;IAC5C;QACE,KAAK,EAAE,wBAAwB;QAC/B,OAAO,EACL,kGAAkG;QACpG,UAAU,EACR,4KAA4K;QAC9K,QAAQ,EAAE,SAAkB;KAC7B;IACD,oCAAoC;IACpC;QACE,KAAK,EAAE,0BAA0B;QACjC,OAAO,EAAE,+EAA+E;QACxF,UAAU,EACR,iLAAiL;QACnL,QAAQ,EAAE,SAAkB;KAC7B;CACF,CAAC;AAEF,iEAAiE;AACjE,MAAM,yBAAyB,GAAG;IAChC,iBAAiB;IACjB,kBAAkB;IAClB,iBAAiB;IACjB,mBAAmB;IACnB,gBAAgB;IAChB,iBAAiB;IACjB,gBAAgB;IAChB,kBAAkB;IAClB,oBAAoB;IACpB,WAAW;IACX,WAAW;CACZ,CAAC;AAEF;;GAEG;AACH,SAAS,kBAAkB,CAAC,OAAe;IACzC,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,sDAAsD;QAC3D,GAAG,EAAE,qDAAqD;KAC3D,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAC3C,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;GAEG;AACH,SAAS,wBAAwB,CAAC,OAAe;IAC/C,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,6DAA6D;QAClE,GAAG,EAAE,iDAAiD;KACvD,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IAChE,MAAM,cAAc,GAClB,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC9F,MAAM,iBAAiB,GACrB,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC/B,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC9B,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAClC,MAAM,eAAe,GACnB,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACjG,OAAO,cAAc,IAAI,iBAAiB,IAAI,eAAe,CAAC;AAChE,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,QAAgB,EAAE,OAAe;IAC1D,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,qDAAqD;QAC1D,GAAG,EAAE,qEAAqE;KAC3E,CAAC,CAAC;IACH,2CAA2C;IAC3C,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,6CAA6C;IAC7C,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;IACxC,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,kBAAkB;IACxB,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IACrE,aAAa,EAAE,eAAe;IAE9B,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,6CAA6C;IAC1D,eAAe,EAAE;;;;;;;;mEAQgD;IACjE,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC;IAC1C,SAAS,EAAE,CAAC,IAAI,CAAC;IAEjB,OAAO,CAAC,OAAe,EAAE,QAAgB;QACvC,MAAM,CAAC,KAAK,CAAC;YACX,GAAG,EAAE,yCAAyC;YAC9C,GAAG,EAAE,6CAA6C;SACnD,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;YAC1C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,UAAU,GAAqB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAElC,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAEzB,gBAAgB;YAChB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxD,SAAS;YACX,CAAC;YAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAC/C,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;gBAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBAC1C,IAAI,KAAK,EAAE,CAAC;oBACV,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI,EAAE,OAAO,GAAG,CAAC;wBACjB,MAAM,EAAE,KAAK,CAAC,KAAK;wBACnB,OAAO,EAAE,OAAO,CAAC,OAAO;wBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;wBAC9B,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;wBACf,QAAQ;qBACT,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/security/auth-middleware-coverage.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @fileoverview Validate routes have authentication middleware
+ */
+/**
+ * Check: security/auth-middleware-coverage
+ *
+ * Validates all routes have proper authentication middleware.
+ * Ensures no endpoints are accidentally exposed without auth.
+ */
+export declare const authMiddlewareCoverage: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=auth-middleware-coverage.d.ts.map

package/dist/checks/security/auth-middleware-coverage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-middleware-coverage.d.ts","sourceRoot":"","sources":["../../../src/checks/security/auth-middleware-coverage.ts"],"names":[],"mappings":"AACA;;GAEG;AA+JH;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,sCAiEjC,CAAC"}

package/dist/checks/security/auth-middleware-coverage.js

@@ -0,0 +1,210 @@
+// @fitness-ignore-file fitness-ignore-validation -- Fitness-ignore directives reference internal check IDs that may not be statically resolvable
+/**
+ * @fileoverview Validate routes have authentication middleware
+ */
+import { logger } from '@opensip-cli/core';
+import { defineCheck } from '@opensip-cli/fitness';
+import { stripStringsAndComments } from '@opensip-cli/fitness';
+/**
+ * Match Fastify route definitions
+ * Pattern: fastify.METHOD('/path', handler)
+ */
+function matchFastifyRoute(line) {
+    logger.debug({
+        evt: 'fitness.checks.auth_middleware_coverage.match_fastify_route',
+        msg: 'Checking for Fastify route definition',
+    });
+    // @fitness-ignore-next-line sonarjs-regular-expr -- Simple pattern with no backtracking risk; negated character class [^'"`]+ is linear
+    return /fastify\.(get|post|put|patch|delete)\s*\(\s*['"`]([^'"`]+)['"`]/i.exec(line);
+}
+/**
+ * Match Express route definitions
+ * Pattern: app.METHOD('/path', handler) or router.METHOD('/path', handler)
+ */
+function matchExpressRoute(line) {
+    logger.debug({
+        evt: 'fitness.checks.auth_middleware_coverage.match_express_route',
+        msg: 'Checking for Express route definition',
+    });
+    // @fitness-ignore-next-line sonarjs-regular-expr -- Simple pattern with no backtracking risk; negated character class [^'"`]+ is linear
+    return /(?:app|router)\.(get|post|put|patch|delete)\s*\(\s*['"`]([^'"`]+)['"`]/i.exec(line);
+}
+// Patterns that indicate route definitions
+const ROUTE_PATTERNS = [
+    // Fastify routes without auth
+    {
+        match: matchFastifyRoute,
+        check: (line) => !hasAuthMiddleware(line) && !isPublicRoute(line),
+        message: 'Route may be missing authentication middleware',
+        suggestion: 'Add auth middleware via preHandler: { preHandler: [authMiddleware] } or use onRequest hook with authentication check.',
+        severity: 'warning',
+    },
+    // Express routes without auth
+    {
+        match: matchExpressRoute,
+        check: (line) => !hasAuthMiddleware(line) && !isPublicRoute(line),
+        message: 'Route may be missing authentication middleware',
+        suggestion: 'Add auth middleware before the route handler: router.get("/path", authMiddleware, handler). Or mark as public: { public: true }.',
+        severity: 'warning',
+    },
+];
+// Keywords indicating auth middleware is present
+const AUTH_MIDDLEWARE_KEYWORDS = [
+    'authmiddleware',
+    'authenticate',
+    'requireauth',
+    'isauthenticated',
+    'verifytoken',
+    'verifyjwt',
+];
+// Keywords indicating intentionally public routes
+const PUBLIC_ROUTE_KEYWORDS = [
+    'public',
+    'skipauth',
+    'noauth',
+    '/health',
+    '/status',
+    '/ping',
+    '/ready',
+    '/live',
+    '/metrics',
+    '/docs',
+    '/swagger',
+    '/openapi',
+    '/.well-known',
+];
+function hasAuthMiddleware(line) {
+    logger.debug({
+        evt: 'fitness.checks.auth_middleware_coverage.has_auth_middleware',
+        msg: 'Checking if line has auth middleware',
+    });
+    const lowerLine = line.toLowerCase();
+    if (AUTH_MIDDLEWARE_KEYWORDS.some((kw) => lowerLine.includes(kw))) {
+        return true;
+    }
+    // Check for preHandler.*auth or onRequest.*auth patterns
+    if ((lowerLine.includes('prehandler') || lowerLine.includes('onrequest')) &&
+        lowerLine.includes('auth')) {
+        return true;
+    }
+    return false;
+}
+function isPublicRoute(line) {
+    logger.debug({
+        evt: 'fitness.checks.auth_middleware_coverage.is_public_route',
+        msg: 'Checking if route is public',
+    });
+    const lowerLine = line.toLowerCase();
+    return PUBLIC_ROUTE_KEYWORDS.some((kw) => lowerLine.includes(kw));
+}
+// Paths to exclude from checking
+const PUBLIC_ROUTE_PATTERNS = ['/health/', '/status/'];
+/**
+ * Check if content contains route-defining framework references
+ */
+function containsRouteFramework(content) {
+    logger.debug({
+        evt: 'fitness.checks.auth_middleware_coverage.contains_route_framework',
+        msg: 'Checking if content contains route framework references',
+    });
+    const stripped = stripStringsAndComments(content);
+    return /(?:fastify|app|router)\.(get|post|put|patch|delete)\s*\(/i.test(stripped);
+}
+/**
+ * Check if file has global auth middleware applied
+ */
+function hasGlobalAuthMiddleware(content) {
+    logger.debug({
+        evt: 'fitness.checks.auth_middleware_coverage.has_global_auth_middleware',
+        msg: 'Checking if file has global auth middleware applied',
+    });
+    const stripped = stripStringsAndComments(content);
+    return /\.register\s*\(\s*auth/i.test(stripped) || /\.use\s*\(\s*auth/i.test(stripped);
+}
+/**
+ * Determine if a file should be processed for auth middleware checks
+ */
+function shouldProcessFile(filePath, content) {
+    logger.debug({
+        evt: 'fitness.checks.auth_middleware_coverage.should_process_file',
+        msg: 'Determining if file should be processed for auth middleware checks',
+    });
+    // Skip excluded paths
+    if (PUBLIC_ROUTE_PATTERNS.some((p) => filePath.includes(p))) {
+        return false;
+    }
+    // Only check files that might define routes
+    if (!containsRouteFramework(content)) {
+        return false;
+    }
+    // If global auth is applied, skip detailed checking
+    if (hasGlobalAuthMiddleware(content)) {
+        return false;
+    }
+    return true;
+}
+/**
+ * Check: security/auth-middleware-coverage
+ *
+ * Validates all routes have proper authentication middleware.
+ * Ensures no endpoints are accidentally exposed without auth.
+ */
+export const authMiddlewareCoverage = defineCheck({
+    id: 'eb8b97f1-3125-4391-be4d-020c74413817',
+    slug: 'auth-middleware-coverage',
+    scope: { languages: ['typescript'], concerns: ['backend', 'server'] },
+    // 'raw', not 'strip-strings': the route matcher needs the quoted route PATH
+    // (`fastify.get('/users', …)`), which string-stripping would blank — making
+    // the `[^'"\`]+` path group unmatchable and the check inert.
+    contentFilter: 'raw',
+    confidence: 'medium',
+    description: 'Validate routes have authentication middleware',
+    longDescription: `**Purpose:** Ensures all Fastify and Express route definitions include authentication middleware, preventing accidental exposure of unprotected endpoints.
+
+**Detects:**
+- Fastify routes: \`fastify.(get|post|put|patch|delete)('/path', ...)\` without auth middleware keywords (authMiddleware, authenticate, requireAuth, verifyToken, verifyJwt) or preHandler/onRequest auth hooks
+- Express routes: \`(app|router).(get|post|put|patch|delete)('/path', ...)\` without auth middleware
+
+**Why it matters:** A single unprotected endpoint can expose sensitive data or allow unauthorized actions. This check catches routes missing auth before they reach production.
+
+**Scope:** General best practice. Analyzes each file individually. Skips files with global auth middleware (\`register\`/\`use\` + \`auth\`) and public routes (/health, /status, /docs, etc.).`,
+    tags: ['security', 'authentication', 'middleware', 'routes'],
+    fileTypes: ['ts'],
+    analyze(content, filePath) {
+        logger.debug({
+            evt: 'fitness.checks.auth_middleware_coverage.analyze',
+            msg: 'Analyzing file for auth middleware coverage',
+        });
+        if (!shouldProcessFile(filePath, content)) {
+            return [];
+        }
+        const violations = [];
+        const lines = content.split('\n');
+        for (let lineNum = 0; lineNum < lines.length; lineNum++) {
+            const line = lines[lineNum] ?? '';
+            // Get context (current line + next few lines)
+            const context = lines.slice(lineNum, lineNum + 5).join(' ');
+            // Skip comments
+            const trimmed = line.trim();
+            if (trimmed.startsWith('//') || trimmed.startsWith('*')) {
+                continue;
+            }
+            for (const pattern of ROUTE_PATTERNS) {
+                const match = pattern.match(line);
+                if (match && pattern.check(context)) {
+                    violations.push({
+                        line: lineNum + 1,
+                        column: match.index,
+                        message: pattern.message,
+                        severity: pattern.severity,
+                        suggestion: pattern.suggestion,
+                        match: match[0],
+                        filePath,
+                    });
+                }
+            }
+        }
+        return violations;
+    },
+});
+//# sourceMappingURL=auth-middleware-coverage.js.map

package/dist/checks/security/auth-middleware-coverage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-middleware-coverage.js","sourceRoot":"","sources":["../../../src/checks/security/auth-middleware-coverage.ts"],"names":[],"mappings":"AAAA,iJAAiJ;AACjJ;;GAEG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAuB,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAE/D;;;GAGG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,6DAA6D;QAClE,GAAG,EAAE,uCAAuC;KAC7C,CAAC,CAAC;IACH,wIAAwI;IACxI,OAAO,kEAAkE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvF,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,6DAA6D;QAClE,GAAG,EAAE,uCAAuC;KAC7C,CAAC,CAAC;IACH,wIAAwI;IACxI,OAAO,yEAAyE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC9F,CAAC;AAED,2CAA2C;AAC3C,MAAM,cAAc,GAAG;IACrB,8BAA8B;IAC9B;QACE,KAAK,EAAE,iBAAiB;QACxB,KAAK,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QACzE,OAAO,EAAE,gDAAgD;QACzD,UAAU,EACR,uHAAuH;QACzH,QAAQ,EAAE,SAAkB;KAC7B;IACD,8BAA8B;IAC9B;QACE,KAAK,EAAE,iBAAiB;QACxB,KAAK,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QACzE,OAAO,EAAE,gDAAgD;QACzD,UAAU,EACR,kIAAkI;QACpI,QAAQ,EAAE,SAAkB;KAC7B;CACF,CAAC;AAEF,iDAAiD;AACjD,MAAM,wBAAwB,GAAG;IAC/B,gBAAgB;IAChB,cAAc;IACd,aAAa;IACb,iBAAiB;IACjB,aAAa;IACb,WAAW;CACZ,CAAC;AAEF,kDAAkD;AAClD,MAAM,qBAAqB,GAAG;IAC5B,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,SAAS;IACT,SAAS;IACT,OAAO;IACP,QAAQ;IACR,OAAO;IACP,UAAU;IACV,OAAO;IACP,UAAU;IACV,UAAU;IACV,cAAc;CACf,CAAC;AAEF,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,6DAA6D;QAClE,GAAG,EAAE,sCAAsC;KAC5C,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,yDAAyD;IACzD,IACE,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrE,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,yDAAyD;QAC9D,GAAG,EAAE,6BAA6B;KACnC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,iCAAiC;AACjC,MAAM,qBAAqB,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;AAEvD;;GAEG;AACH,SAAS,sBAAsB,CAAC,OAAe;IAC7C,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,kEAAkE;QACvE,GAAG,EAAE,yDAAyD;KAC/D,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAClD,OAAO,2DAA2D,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACpF,CAAC;AAED;;GAEG;AACH,SAAS,uBAAuB,CAAC,OAAe;IAC9C,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,oEAAoE;QACzE,GAAG,EAAE,qDAAqD;KAC3D,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAClD,OAAO,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACzF,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,QAAgB,EAAE,OAAe;IAC1D,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,6DAA6D;QAClE,GAAG,EAAE,oEAAoE;KAC1E,CAAC,CAAC;IACH,sBAAsB;IACtB,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,4CAA4C;IAC5C,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,oDAAoD;IACpD,IAAI,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAAC;IAChD,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,0BAA0B;IAChC,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IACrE,4EAA4E;IAC5E,4EAA4E;IAC5E,6DAA6D;IAC7D,aAAa,EAAE,KAAK;IAEpB,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,gDAAgD;IAC7D,eAAe,EAAE;;;;;;;;gMAQ6K;IAC9L,IAAI,EAAE,CAAC,UAAU,EAAE,gBAAgB,EAAE,YAAY,EAAE,QAAQ,CAAC;IAC5D,SAAS,EAAE,CAAC,IAAI,CAAC;IAEjB,OAAO,CAAC,OAAe,EAAE,QAAgB;QACvC,MAAM,CAAC,KAAK,CAAC;YACX,GAAG,EAAE,iDAAiD;YACtD,GAAG,EAAE,6CAA6C;SACnD,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;YAC1C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,UAAU,GAAqB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAElC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAElC,8CAA8C;YAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAE5D,gBAAgB;YAChB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxD,SAAS;YACX,CAAC;YAED,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;gBACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAClC,IAAI,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;oBACpC,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI,EAAE,OAAO,GAAG,CAAC;wBACjB,MAAM,EAAE,KAAK,CAAC,KAAK;wBACnB,OAAO,EAAE,OAAO,CAAC,OAAO;wBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;wBAC9B,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;wBACf,QAAQ;qBACT,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/security/auth-route-guard.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @fileoverview Verify auth group routes are protected
+ */
+/**
+ * Check: security/auth-route-guard
+ *
+ * Verifies that routes in the (auth) group are properly protected
+ * by global auth state. Layout files in (auth) directories should
+ * include authentication checks.
+ */
+export declare const authRouteGuard: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=auth-route-guard.d.ts.map

package/dist/checks/security/auth-route-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-route-guard.d.ts","sourceRoot":"","sources":["../../../src/checks/security/auth-route-guard.ts"],"names":[],"mappings":"AAAA;;GAEG;AAkBH;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,sCAoDzB,CAAC"}

package/dist/checks/security/auth-route-guard.js

@@ -0,0 +1,70 @@
+/**
+ * @fileoverview Verify auth group routes are protected
+ */
+import { logger } from '@opensip-cli/core';
+import { defineCheck } from '@opensip-cli/fitness';
+// Patterns indicating auth protection
+const AUTH_PROTECTION_PATTERNS = [
+    /useAuth/,
+    /useSession/,
+    /isAuthenticated/,
+    /authState/,
+    /requireAuth/,
+    /withAuth/,
+    /ProtectedRoute/,
+    /AuthGuard/,
+    /useUser/,
+];
+/**
+ * Check: security/auth-route-guard
+ *
+ * Verifies that routes in the (auth) group are properly protected
+ * by global auth state. Layout files in (auth) directories should
+ * include authentication checks.
+ */
+export const authRouteGuard = defineCheck({
+    id: 'e33d59ea-da9d-45c0-bab7-037f737b8560',
+    slug: 'auth-route-guard',
+    disabled: true,
+    scope: { languages: ['typescript'], concerns: ['backend', 'server'] },
+    contentFilter: 'strip-strings',
+    confidence: 'medium',
+    description: 'Verify (auth) group _layout files include authentication checks (useAuth/useSession hooks)',
+    longDescription: `**Purpose:** Ensures Expo Router \`(auth)\` group layout files contain an authentication check, so protected routes redirect unauthenticated users.
+
+**Detects:**
+- \`_layout\` files inside \`(auth)\` directories that do not reference any auth protection pattern: \`useAuth\`, \`useSession\`, \`isAuthenticated\`, \`authState\`, \`requireAuth\`, \`withAuth\`, \`ProtectedRoute\`, \`AuthGuard\`, or \`useUser\`
+
+**Why it matters:** Without an auth guard in the layout, users can navigate directly to protected screens without being authenticated, bypassing access control.
+
+**Scope:** Codebase-specific convention for Expo Router auth groups. Analyzes each file individually.`,
+    tags: ['security', 'authentication', 'routes', 'expo'],
+    fileTypes: ['ts', 'tsx'],
+    analyze(content, filePath) {
+        logger.debug({
+            evt: 'fitness.checks.auth_route_guard.analyze',
+            msg: 'Analyzing file for auth route guard compliance',
+        });
+        // Only check auth group layout files
+        if (!filePath.includes('(auth)') || !filePath.includes('_layout')) {
+            return [];
+        }
+        // Check if file has auth protection
+        const hasAuthCheck = AUTH_PROTECTION_PATTERNS.some((pattern) => pattern.test(content));
+        if (!hasAuthCheck) {
+            return [
+                {
+                    line: 1,
+                    column: 0,
+                    message: 'Auth group layout missing authentication check - add useAuth hook and redirect unauthenticated users',
+                    severity: 'warning',
+                    suggestion: 'Add useAuth() or useSession() hook at the top of the layout component and redirect to login if not authenticated: const { isAuthenticated } = useAuth(); if (!isAuthenticated) return <Redirect href="/login" />;',
+                    match: '(auth)/_layout',
+                    filePath,
+                },
+            ];
+        }
+        return [];
+    },
+});
+//# sourceMappingURL=auth-route-guard.js.map

package/dist/checks/security/auth-route-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-route-guard.js","sourceRoot":"","sources":["../../../src/checks/security/auth-route-guard.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAuB,MAAM,sBAAsB,CAAC;AAExE,sCAAsC;AACtC,MAAM,wBAAwB,GAAG;IAC/B,SAAS;IACT,YAAY;IACZ,iBAAiB;IACjB,WAAW;IACX,aAAa;IACb,UAAU;IACV,gBAAgB;IAChB,WAAW;IACX,SAAS;CACV,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;IACxC,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,kBAAkB;IACxB,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IACrE,aAAa,EAAE,eAAe;IAE9B,UAAU,EAAE,QAAQ;IACpB,WAAW,EACT,4FAA4F;IAC9F,eAAe,EAAE;;;;;;;sGAOmF;IACpG,IAAI,EAAE,CAAC,UAAU,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,CAAC;IACtD,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;IAExB,OAAO,CAAC,OAAe,EAAE,QAAgB;QACvC,MAAM,CAAC,KAAK,CAAC;YACX,GAAG,EAAE,yCAAyC;YAC9C,GAAG,EAAE,gDAAgD;SACtD,CAAC,CAAC;QACH,qCAAqC;QACrC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAClE,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,oCAAoC;QACpC,MAAM,YAAY,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAEvF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;gBACL;oBACE,IAAI,EAAE,CAAC;oBACP,MAAM,EAAE,CAAC;oBACT,OAAO,EACL,sGAAsG;oBACxG,QAAQ,EAAE,SAAS;oBACnB,UAAU,EACR,mNAAmN;oBACrN,KAAK,EAAE,gBAAgB;oBACvB,QAAQ;iBACT;aACF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/security/cors-configuration.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @fileoverview Validate CORS configuration follows security best practices
+ */
+/**
+ * Check: security/cors-configuration
+ *
+ * Validates CORS configuration is properly restrictive.
+ * Prevents overly permissive cross-origin access.
+ */
+export declare const corsConfiguration: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=cors-configuration.d.ts.map

package/dist/checks/security/cors-configuration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors-configuration.d.ts","sourceRoot":"","sources":["../../../src/checks/security/cors-configuration.ts"],"names":[],"mappings":"AACA;;GAEG;AAmEH;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,sCAiE5B,CAAC"}