@soulbatical/tetra-dev-toolkit 1.16.1 → 1.16.2

package/lib/checks/security/systemdb-whitelist.js

@@ -135,50 +135,53 @@ export async function run(config, projectRoot) {
 
     if (whitelistMatch) {
       const rawLines = whitelistMatch[1].split('\n')
-      let lastComment = null
+      let groupComment = null
 
       for (let i = 0; i < rawLines.length; i++) {
         const line = rawLines[i].trim()
 
-        // Track comments — group comments (// ...) or inline comments
-        const commentMatch = line.match(/^\s*\/\/\s*(.+)/)
-        if (commentMatch) {
-          lastComment = commentMatch[1].trim()
+        // Track group comments — a comment line that is NOT inline with an entry
+        // Group comments apply to ALL entries below them until the next group comment
+        if (/^\s*\/\//.test(line) && !line.match(/['"][^'"]+['"]/)) {
+          const commentText = line.replace(/^\s*\/\/\s*/, '').trim()
+          if (commentText.length > 0) {
+            groupComment = commentText
+          }
           continue
         }
 
+        // Skip empty lines (don't reset group comment)
+        if (!line || line === ',') continue
+
         const entryMatch = line.match(/['"]([^'"]+)['"]/)
-        if (!entryMatch) { continue }
+        if (!entryMatch) continue
 
         const entry = entryMatch[1]
         whitelist.add(entry)
 
         // Check for inline comment: 'entry', // reason
         const inlineCommentMatch = line.match(/['"][^'"]+['"]\s*,?\s*\/\/\s*(.+)/)
-        const reason = inlineCommentMatch ? inlineCommentMatch[1].trim() : lastComment
+        const inlineReason = inlineCommentMatch ? inlineCommentMatch[1].trim() : null
+
+        // Entry is justified if it has an inline comment OR falls under a group comment
+        const hasJustification = inlineReason || groupComment
 
-        // Find line number in original file
-        const entryLineInFile = systemDbContent.substring(0, systemDbContent.indexOf(entry)).split('\n').length
+        if (!hasJustification) {
+          // Find line number in original file
+          const entryLineInFile = systemDbContent.substring(0, systemDbContent.indexOf(entry)).split('\n').length
 
-        if (!reason) {
           results.findings.push({
             file: systemDbPath.replace(projectRoot + '/', ''),
             line: entryLineInFile,
             type: 'whitelist-no-justification',
             severity: 'high',
-            message: `systemDB whitelist entry '${entry}' has NO comment explaining WHY it needs service role key access. Every whitelist entry MUST have a comment above or inline.`,
+            message: `systemDB whitelist entry '${entry}' has NO comment explaining WHY it needs service role key access. Add a group comment above or an inline comment.`,
             fix: `Add a comment explaining why '${entry}' cannot use adminDB/userDB. Example:\n  // OAuth callback — browser redirect, no JWT in header\n  '${entry}',`
           })
           results.summary.high++
           results.summary.total++
           results.passed = false
         }
-
-        // Reset lastComment after consuming it for a non-dynamic entry
-        // (don't reset for "// Dynamic:" comments which apply to patterns, not specific entries)
-        if (lastComment && !lastComment.toLowerCase().startsWith('dynamic')) {
-          lastComment = null
-        }
       }
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@soulbatical/tetra-dev-toolkit",
-  "version": "1.16.1",
+  "version": "1.16.2",
   "publishConfig": {
     "access": "restricted"
   },