@soulbatical/tetra-dev-toolkit 1.20.16 → 1.20.17

package/lib/checks/security/route-config-alignment.js

@@ -103,26 +103,38 @@ function hasOrgAdminMiddleware(content) {
 }
 
 /**
- * Check if admin routes are protected by a RouteManager group-level middleware.
- * Many projects apply auth middleware at the route group level (e.g., all /api/admin/* routes)
- * rather than in individual route files.
+ * Check if admin routes are protected by group-level middleware.
+ *
+ * Supports two patterns:
+ * 1. RouteManager: explicit authenticateToken in routes/index.ts or RouteManager.ts
+ * 2. createApp declarative routes: `access: 'admin'` in index.ts/app.ts
+ *    → createApp auto-injects authenticateToken + requireOrgAdmin for access='admin'
  */
 function hasRouteManagerGroupAuth(projectRoot) {
   const candidates = [
     join(projectRoot, 'backend/src/core/RouteManager.ts'),
     join(projectRoot, 'src/core/RouteManager.ts'),
     join(projectRoot, 'backend/src/routes/index.ts'),
-    join(projectRoot, 'src/routes/index.ts')
+    join(projectRoot, 'src/routes/index.ts'),
+    join(projectRoot, 'backend/src/index.ts'),
+    join(projectRoot, 'src/index.ts'),
+    join(projectRoot, 'backend/src/app.ts'),
+    join(projectRoot, 'src/app.ts')
   ]
 
   for (const file of candidates) {
     if (!existsSync(file)) continue
     try {
       const content = readFileSync(file, 'utf-8')
-      // Check for group middleware pattern: prefix '/api/admin' with authenticateToken
+      // Pattern 1: RouteManager with explicit authenticateToken for /api/admin
       if (/\/api\/admin/.test(content) && /authenticateToken/.test(content)) {
         return true
       }
+      // Pattern 2: createApp declarative routes — access: 'admin' auto-injects auth
+      // createApp guarantees authenticateToken + requireOrgAdmin for access='admin'
+      if (/createApp/.test(content) && /access:\s*['"]admin['"]/.test(content)) {
+        return true
+      }
     } catch { /* skip */ }
   }
   return false

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@soulbatical/tetra-dev-toolkit",
-  "version": "1.20.16",
+  "version": "1.20.17",
   "publishConfig": {
     "access": "restricted"
   },