@uniqweb/vibe-it-securely 0.0.0-stage → 0.1.0

package/src/init.js

@@ -0,0 +1,55 @@
+import fs from "node:fs";
+import path from "node:path";
+import { detectStack } from "./detect.js";
+import { safeWrite } from "./safe-write.js";
+import * as t from "./templates.js";
+
+export function init({ dir, dryRun = false, docker = true }) {
+  const stack = detectStack(dir);
+  if (!stack.node && !stack.python) {
+    return { stack, results: [], notes: [], error: "No supported project found (looked for package.json, requirements.txt, pyproject.toml, Pipfile, setup.py)." };
+  }
+
+  const files = [
+    { path: ".pre-commit-config.yaml", content: t.preCommit() },
+    { path: ".github/workflows/security.yml", content: t.ciWorkflow(stack) },
+    { path: "AGENTS.md", content: t.agentRules(stack) },
+  ];
+
+  if (!docker) {
+    // libraries, CLIs and scripts do not need container files
+  } else if (stack.node && stack.python) {
+    files.push(
+      { path: ".dockerignore", content: t.dockerignore() },
+    );
+    files.push({ path: "Dockerfile.node", content: t.dockerfileNode(stack) });
+    files.push({ path: "Dockerfile.python", content: t.dockerfilePython(stack) });
+  } else if (stack.node) {
+    files.push({ path: ".dockerignore", content: t.dockerignore() });
+    files.push({ path: "Dockerfile", content: t.dockerfileNode(stack) });
+  } else {
+    files.push({ path: ".dockerignore", content: t.dockerignore() });
+    files.push({ path: "Dockerfile", content: t.dockerfilePython(stack) });
+  }
+
+  const results = files.map((f) => safeWrite(dir, f.path, f.content, { dryRun }));
+  // Quiet extras: only create if missing, never write .suggested copies
+  results.push(safeWrite(dir, ".env.example", t.envExample(), { dryRun, onExists: "skip" }));
+  results.push(safeWrite(dir, ".gitleaksignore", t.gitleaksIgnore(), { dryRun, onExists: "skip" }));
+
+  const notes = [];
+  const giPath = path.join(dir, ".gitignore");
+  if (!fs.existsSync(giPath)) {
+    results.push(safeWrite(dir, ".gitignore", t.gitignore(), { dryRun }));
+  } else {
+    const lines = fs.readFileSync(giPath, "utf8").split(/\r?\n/).map((l) => l.trim());
+    if (!lines.some((l) => l === ".env" || l === ".env*" || l === "*.env")) {
+      notes.push("Your .gitignore does not ignore .env files. Anyone who creates a .env could accidentally commit their secrets. Add a line containing: .env");
+    }
+  }
+  if (stack.node && !stack.hasNodeLock && stack.packageManager === "npm") {
+    notes.push("No package-lock.json found. Commit one so installs are reproducible and dependency audits are accurate.");
+  }
+
+  return { stack, results, notes };
+}

package/src/report.js

@@ -0,0 +1,59 @@
+import { RULES } from "./check.js";
+
+const ORDER = ["high", "medium", "info"];
+const LABEL = { high: "HIGH  ", medium: "MEDIUM", info: "INFO  " };
+const HEADING = {
+  high: "Fix these first",
+  medium: "Should fix",
+  info: "Suggestions",
+};
+
+/** Plain-text report. Never prints matched secret values, only locations. */
+export function formatReport(result, { maxLocations = 5 } = {}) {
+  const { findings, filesScanned } = result;
+  const out = [];
+
+  const groups = new Map();
+  for (const f of findings) {
+    if (!groups.has(f.ruleId)) groups.set(f.ruleId, []);
+    groups.get(f.ruleId).push(f);
+  }
+
+  const counts = { high: 0, medium: 0, info: 0 };
+  for (const [ruleId, list] of groups) counts[RULES[ruleId].severity] += list.length;
+
+  for (const sev of ORDER) {
+    const ruleIds = [...groups.keys()].filter((id) => RULES[id].severity === sev);
+    if (!ruleIds.length) continue;
+    out.push(`== ${HEADING[sev]} ==`, "");
+    for (const id of ruleIds) {
+      const rule = RULES[id];
+      const list = groups.get(id);
+      out.push(`[${LABEL[sev]}] ${rule.title}`);
+      const located = list.filter((f) => f.file);
+      if (located.length) {
+        const shown = located.slice(0, maxLocations).map((f) => (f.line ? `${f.file}:${f.line}` : f.file) + (f.detail ? ` (${f.detail})` : ""));
+        const more = located.length - shown.length;
+          out.push(`  Where: ${shown.join(", ")}${more > 0 ? `, and ${more} more` : ""}`);
+      }
+      out.push(`  Why:   ${rule.why}`, `  Fix:   ${rule.fix}`, "");
+    }
+  }
+
+  for (const n of result.notes || []) out.push(n);
+  if ((result.notes || []).length) out.push("");
+  const total = counts.high + counts.medium + counts.info;
+  out.push(`Scanned ${filesScanned} files. Found ${counts.high} high, ${counts.medium} medium, ${counts.info} info.`);
+  if (total === 0) out.push("Nothing found by these checks.");
+  out.push(
+    "This is a baseline check, not a security audit. A clean result does not mean your project is secure.",
+    "False alarm? Add the comment vibe-it-securely-ignore to that line.",
+  );
+  return out.join("\n");
+}
+
+export function countBySeverity(findings) {
+  const c = { high: 0, medium: 0, info: 0 };
+  for (const f of findings) c[f.severity]++;
+  return c;
+}

package/src/safe-write.js

@@ -0,0 +1,27 @@
+import fs from "node:fs";
+import path from "node:path";
+
+/**
+ * Write a file without ever overwriting an existing one.
+ * If the target exists, write "<name>.suggested" next to it
+ * (or skip entirely when onExists === "skip").
+ */
+export function safeWrite(dir, relPath, content, { dryRun = false, onExists = "suggest" } = {}) {
+  const exists = fs.existsSync(path.join(dir, relPath));
+  let outRel = relPath;
+  let status = "created";
+
+  if (exists) {
+    if (onExists === "skip") return { path: relPath, status: "skipped-exists" };
+    outRel = relPath + ".suggested";
+    if (fs.existsSync(path.join(dir, outRel))) return { path: outRel, status: "skipped-exists" };
+    status = "suggested";
+  }
+
+  if (!dryRun) {
+    const out = path.join(dir, outRel);
+    fs.mkdirSync(path.dirname(out), { recursive: true });
+    fs.writeFileSync(out, content, { flag: "wx" }); // wx = fail rather than overwrite
+  }
+  return { path: outRel, status: dryRun ? "would-be-" + status : status };
+}

package/src/templates.js

@@ -0,0 +1,244 @@
+const L = (...lines) => lines.flat().join("\n") + "\n";
+
+export function preCommit() {
+  return L(
+    "# Generated by vibe-it-securely.",
+    "# FAST local checks. CI re-runs them, because hooks can be bypassed (git commit --no-verify).",
+    "# Install once:  pip install pre-commit && pre-commit install",
+    "repos:",
+    "  - repo: https://github.com/pre-commit/pre-commit-hooks",
+    "    rev: v4.6.0",
+    "    hooks:",
+    "      - id: detect-private-key",
+    "      - id: check-added-large-files",
+    "  - repo: https://github.com/gitleaks/gitleaks",
+    "    rev: v8.18.4",
+    "    hooks:",
+    "      - id: gitleaks",
+  );
+}
+
+export function ciWorkflow(stack) {
+  const steps = [
+    "      - uses: actions/checkout@v4",
+    "        with:",
+    "          fetch-depth: 0",
+    "      - uses: actions/setup-python@v5",
+    "        with:",
+    "          python-version: \"3.12\"",
+    "",
+    "      # False alarm on a fake value? Add the finding Fingerprint to .gitleaksignore",
+    "      - name: Secret scan (blocking)",
+    "        run: |",
+    "          curl -sSL https://github.com/gitleaks/gitleaks/releases/download/v8.18.4/gitleaks_8.18.4_linux_x64.tar.gz | tar -xz gitleaks",
+    "          ./gitleaks detect --source . --redact --verbose",
+    "      - name: Hygiene hooks (blocking)",
+    "        run: |",
+    "          pip install pre-commit",
+    "          SKIP=gitleaks pre-commit run --all-files",
+  ];
+
+  if (stack.node) {
+    steps.push(
+      "",
+      "      - uses: actions/setup-node@v4",
+      "        with:",
+      "          node-version: \"22\"",
+    );
+    if (stack.packageManager === "pnpm") {
+      steps.push(
+        "      - name: Dependency audit, critical only (blocking)",
+        "        run: |",
+        "          corepack enable",
+        "          pnpm audit --audit-level critical",
+      );
+    } else if (stack.packageManager === "yarn") {
+      steps.push(
+        "      - name: Dependency audit, critical only (blocking)",
+        "        # TODO: Yarn Berry uses \"yarn npm audit\" instead.",
+        "        run: yarn audit --level critical",
+      );
+    } else {
+      steps.push("      - name: Dependency audit, critical only (blocking)", "        run: |");
+      if (!stack.hasNodeLock) steps.push("          npm install --package-lock-only --ignore-scripts");
+      steps.push("          npm audit --audit-level=critical");
+    }
+  }
+
+  if (stack.python) {
+    const target =
+      stack.pythonDeps === "requirements.txt" ? "-r requirements.txt" : stack.pythonDeps === "pipfile" ? "" : ".";
+    steps.push(
+      "",
+      "      - name: Python dependency audit (warning only: pip-audit cannot filter by severity)",
+      "        continue-on-error: true",
+      "        run: |",
+      "          pip install pip-audit",
+      target
+        ? "          pip-audit " + target
+        : "          # TODO: Pipfile detected. Run: pipenv requirements | pip-audit -r /dev/stdin",
+    );
+  }
+
+  steps.push(
+    "",
+    "      - name: Static analysis, errors only (blocking)",
+    "        run: |",
+    "          pip install semgrep",
+    "          semgrep scan --config p/default --severity ERROR --error",
+    "      - name: Static analysis, warnings (report only)",
+    "        continue-on-error: true",
+    "        run: semgrep scan --config p/default --severity WARNING",
+  );
+
+  return L(
+    "# Generated by vibe-it-securely. This is a security BASELINE, not a guarantee of security.",
+    "# TODO: pin third-party actions to commit SHAs for stronger supply-chain safety.",
+    "name: Security baseline",
+    "on:",
+    "  push:",
+    "    branches: [main]",
+    "  pull_request:",
+    "permissions:",
+    "  contents: read",
+    "jobs:",
+    "  baseline:",
+    "    runs-on: ubuntu-latest",
+    "    steps:",
+    steps,
+  );
+}
+
+export function dockerfileNode(stack) {
+  const pm = stack.packageManager || "npm";
+  const copy = pm === "pnpm" ? "package.json pnpm-lock.yaml*" : pm === "yarn" ? "package.json yarn.lock*" : "package*.json";
+  const install =
+    pm === "pnpm"
+      ? "corepack enable && pnpm install --frozen-lockfile"
+      : pm === "yarn"
+        ? "corepack enable && yarn install --frozen-lockfile"
+        : stack.hasNodeLock
+          ? "npm ci"
+          : "npm install";
+  const prune = pm === "pnpm" ? "pnpm prune --prod" : pm === "npm" ? "npm prune --omit=dev" : null;
+
+  return L(
+    "# syntax=docker/dockerfile:1",
+    "# Generated by vibe-it-securely. TODO: pin base images by digest (node:22-slim@sha256:...).",
+    "FROM node:22-slim AS build",
+    "WORKDIR /app",
+    "COPY " + copy + " ./",
+    "RUN " + install,
+    "COPY . .",
+    "# TODO: if your project has a build step (TypeScript, bundlers), enable:",
+    "# RUN npm run build",
+    prune ? "RUN " + prune : "# TODO: remove dev dependencies for this package manager",
+    "",
+    "FROM node:22-slim",
+    "ENV NODE_ENV=production",
+    "WORKDIR /app",
+    "# Run as the unprivileged node user, never as root",
+    "COPY --from=build --chown=node:node /app /app",
+    "USER node",
+    "EXPOSE 3000",
+    "# TODO: confirm npm start runs your app",
+    "CMD [\"npm\", \"start\"]",
+  );
+}
+
+export function dockerfilePython(stack) {
+  const reqs = stack.pythonDeps === "requirements.txt";
+  return L(
+    "# syntax=docker/dockerfile:1",
+    "# Generated by vibe-it-securely. TODO: pin base images by digest (python:3.12-slim@sha256:...).",
+    "FROM python:3.12-slim AS build",
+    "WORKDIR /app",
+    "ENV PIP_NO_CACHE_DIR=1",
+    "RUN python -m venv /opt/venv",
+    "ENV PATH=\"/opt/venv/bin:$PATH\"",
+    reqs
+      ? ["COPY requirements.txt ./", "RUN pip install -r requirements.txt"]
+      : ["COPY . .", "RUN pip install ."],
+    "",
+    "FROM python:3.12-slim",
+    "ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 PATH=\"/opt/venv/bin:$PATH\"",
+    "# Run as an unprivileged user, never as root",
+    "RUN useradd --create-home --uid 10001 app",
+    "WORKDIR /app",
+    "COPY --from=build /opt/venv /opt/venv",
+    "COPY --chown=app:app . .",
+    "USER app",
+    "EXPOSE 8000",
+    "# TODO: replace with your real start command",
+    "CMD [\"python\", \"main.py\"]",
+  );
+}
+
+export function dockerignore() {
+  return L(".git", ".env", ".env.*", "!.env.example", "*.pem", "*.key", "node_modules", "__pycache__", ".venv", ".github", "Dockerfile*");
+}
+
+export function envExample() {
+  return L(
+    "# Copy to .env and fill in real values. NEVER commit .env.",
+    "# Keep placeholders here, never real secrets.",
+    "DATABASE_URL=",
+    "API_KEY=",
+    "SECRET_KEY=",
+  );
+}
+
+export function gitleaksIgnore() {
+  return L(
+    "# Generated by secure-baseline.",
+    "# Secret-scan false alarm? Copy the Fingerprint line from the CI log into this file, one per line.",
+    "# Only do this for fake or example values. For a real secret: revoke it and replace it.",
+  );
+}
+
+export function gitignore() {
+  return L(".env", ".env.*", "!.env.example", "node_modules/", "__pycache__/", ".venv/", "*.pem", "*.key");
+}
+
+export function agentRules(stack) {
+  const rules = [
+    "# Security rules for AI coding assistants",
+    "",
+    "Generated by vibe-it-securely. Follow these in all code you write or modify.",
+    "",
+    "## Always",
+    "- Never hardcode secrets, tokens, passwords or API keys. Read them from environment variables and add new ones to `.env.example` with empty values.",
+    "- Validate and sanitize all external input (request bodies, query params, files, env vars).",
+    "- Use parameterized queries or an ORM. Never build SQL by string concatenation.",
+    "- Add authentication AND authorization checks to every endpoint that touches user data.",
+    "- Keep CORS restrictive: list allowed origins explicitly, never `*` with credentials.",
+    "- Do not log secrets, tokens or personal data.",
+    "- Prefer well-maintained libraries; do not add a dependency for something trivial.",
+    "- Run containers as a non-root user.",
+    "",
+    "## Never",
+    "- Never disable TLS verification or security linters to make an error go away.",
+    "- Never commit `.env`, private keys or credentials.",
+    "- Never use `--no-verify` to skip the pre-commit hooks.",
+  ];
+  if (stack.node) {
+    rules.push(
+      "",
+      "## JavaScript / TypeScript",
+      "- Never use `eval`, `new Function`, or `child_process.exec` with user input.",
+      "- Validate request data with a schema library (e.g. zod) at the API boundary.",
+      "- Never render user input with `dangerouslySetInnerHTML` or `innerHTML` unsanitized.",
+    );
+  }
+  if (stack.python) {
+    rules.push(
+      "",
+      "## Python",
+      "- Never use `eval`, `exec`, `pickle.loads` on untrusted data, or `subprocess` with `shell=True` and user input.",
+      "- Use `yaml.safe_load`, never `yaml.load`.",
+      "- Use `secrets` (not `random`) for tokens and anything security-related.",
+    );
+  }
+  rules.push("", "If a task seems to require breaking a rule above, stop and ask the user first.");
+  return L(rules);
+}

package/src/vibe.js

@@ -0,0 +1,142 @@
+import fs from "node:fs";
+import path from "node:path";
+
+const IGNORE = "vibe-it-securely-ignore";
+
+// ---------------------------------------------------------------------------
+// Secrets that leak through naming mistakes
+// ---------------------------------------------------------------------------
+
+/** Env variables that are exposed to the browser but are named like secrets. */
+export const PUBLIC_ENV = /\b(?:NEXT_PUBLIC|VITE|REACT_APP|EXPO_PUBLIC|NUXT_PUBLIC|PUBLIC)_[A-Z0-9_]*(?:SERVICE_ROLE|SECRET|PRIVATE_KEY|PASSWORD)[A-Z0-9_]*/;
+
+export const JWT_RE = /eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/;
+
+/** Reads the "role" claim of a JWT without verifying it. Returns null if unreadable. */
+export function jwtRole(token) {
+  try {
+    const payload = token.split(".")[1].replace(/-/g, "+").replace(/_/g, "/");
+    return JSON.parse(Buffer.from(payload, "base64").toString("utf8")).role ?? null;
+  } catch {
+    return null;
+  }
+}
+
+export const SERVICE_LITERAL = /service_?role\w*["']?\s*[:=]\s*["'`]([A-Za-z0-9._-]{20,})["'`]/i;
+const PLACEHOLDER = /(your|example|change.?me|placeholder|dummy|sample|xxxx|\*\*\*\*|todo|<.*>)/i;
+
+/** Per-line Supabase / public-env checks. Returns a rule id or null. */
+export function lineSecretRule(line) {
+  const jwt = line.match(JWT_RE);
+  if (jwt && jwtRole(jwt[0]) === "service_role") return "supabase-service-key";
+  const lit = line.match(SERVICE_LITERAL);
+  if (lit && !PLACEHOLDER.test(lit[1])) return "supabase-service-key";
+  if (PUBLIC_ENV.test(line)) return "public-env-secret";
+  return null;
+}
+
+// ---------------------------------------------------------------------------
+// Routes that change data without any sign of authentication
+// ---------------------------------------------------------------------------
+
+const ROUTE_RE = /\b(?:app|router|server|fastify|\w*Router|\w*router)\.(post|put|patch|delete)\s*\(\s*(["'`])([^"'`]+)\2/;
+const ANY_ROUTE = /\b(?:app|router|server|fastify|\w*Router|\w*router)\.(?:get|post|put|patch|delete)\s*\(/;
+const PUBLIC_PATH = /(login|log-in|signin|sign-in|signup|sign-up|register|webhook|callback|health|ping|auth|csrf|logout|forgot|reset-password|contact|subscribe|newsletter|public)/i;
+const AUTH_ARGS = /(auth|jwt|verify|protect|passport|session|token|guard|login|requireUser|isLoggedIn|ensure|permission|role|clerk|middleware)/i;
+const AUTH_USE = /(auth|jwt|verify|passport|session|protect|guard|token|clerk)/i;
+const AUTH_BODY = /(req\.user|req\.session|req\.auth|getUser|getSession|getServerSession|currentUser|verifyToken|jwt\.verify|authorization|\b401\b|\b403\b|unauthori[sz]ed|forbidden|isAuthenticated)/i;
+const NEXT_AUTH = /(getServerSession|getSession|\bauth\(\)|currentUser|getToken|getUser|verifyToken|jwt|withAuth|requireAuth|clerk|supabase\.auth|authorization|req\.user|session)/i;
+const NEXT_APP_ROUTE = /(^|\/)app\/(?:.*\/)?route\.(?:[jt]sx?|mjs)$/;
+const NEXT_PAGES_API = /(^|\/)pages\/api\//;
+const NEXT_APP_EXPORT = /export\s+(?:async\s+function|function|const)\s+(?:POST|PUT|PATCH|DELETE)\b/;
+const NEXT_PAGES_MUTATION = /req\.method\s*===?\s*["'](?:POST|PUT|PATCH|DELETE)["']|\.(?:insert|update|delete|create|upsert|destroy)\w*\s*\(/;
+
+/** Heuristic: flags routes that change data and show no sign of an auth check. */
+export function checkRoutes(rel, lines, add) {
+  if (/\.(test|spec)\.[jt]sx?$/.test(rel) || /(^|\/)(tests?|__tests__)\//.test(rel)) return;
+  const text = lines.join("\n");
+
+  if (NEXT_APP_ROUTE.test(rel) || NEXT_PAGES_API.test(rel)) {
+    if (PUBLIC_PATH.test(rel) || NEXT_AUTH.test(text)) return;
+    const pattern = NEXT_APP_ROUTE.test(rel) ? NEXT_APP_EXPORT : NEXT_PAGES_MUTATION;
+    const idx = lines.findIndex((l) => pattern.test(l) && !l.includes(IGNORE));
+    if (idx >= 0) add("js-route-no-auth", rel, idx + 1);
+    return;
+  }
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const m = line.match(ROUTE_RE);
+    if (!m || line.includes(IGNORE) || PUBLIC_PATH.test(m[3])) continue;
+
+    // 1. middleware listed in the route arguments, before the handler starts
+    const win = lines.slice(i, i + 4).join("\n");
+    const after = win.slice(win.indexOf(m[0]) + m[0].length);
+    const cut = after.search(/=>|function|;|\.(?:get|post|put|patch|delete|use)\s*\(/);
+    if (AUTH_ARGS.test(cut >= 0 ? after.slice(0, cut) : after)) continue;
+
+    // 2. an auth middleware registered earlier for the whole app/router
+    if (lines.slice(0, i).some((l) => /\.use\s*\(/.test(l) && AUTH_USE.test(l))) continue;
+
+    // 3. an auth check inside the handler
+    let body = [];
+    for (let j = i + 1; j < Math.min(lines.length, i + 26) && !ANY_ROUTE.test(lines[j]); j++) body.push(lines[j]);
+    if (AUTH_BODY.test(body.join("\n"))) continue;
+
+    add("js-route-no-auth", rel, i + 1);
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Supabase row level security (SQL migrations)
+// ---------------------------------------------------------------------------
+
+const stripSqlComments = (s) => s.replace(/--.*$/gm, (c) => " ".repeat(c.length));
+
+export function analyzeSql(dir, sqlFiles, usesSupabase, add) {
+  if (!usesSupabase) return;
+  const created = new Map(); // table -> {file, line}
+  const enabled = new Set();
+
+  for (const rel of sqlFiles) {
+    let raw;
+    try {
+      raw = fs.readFileSync(path.join(dir, rel), "utf8");
+    } catch {
+      continue;
+    }
+    const text = stripSqlComments(raw);
+    const lineOf = (index) => text.slice(0, index).split("\n").length;
+
+    for (const m of text.matchAll(/disable\s+row\s+level\s+security/gi)) {
+      if (!raw.split("\n")[lineOf(m.index) - 1]?.includes(IGNORE)) add("sql-rls-disabled", rel, lineOf(m.index));
+    }
+    for (const m of text.matchAll(/create\s+table\s+(?:if\s+not\s+exists\s+)?(?:"?(\w+)"?\.)?"?(\w+)"?/gi)) {
+      const schema = (m[1] || "public").toLowerCase();
+      if (schema !== "public") continue;
+      created.set(m[2].toLowerCase(), { file: rel, line: lineOf(m.index) });
+    }
+    for (const m of text.matchAll(/alter\s+table\s+(?:only\s+)?(?:"?(\w+)"?\.)?"?(\w+)"?\s+enable\s+row\s+level\s+security/gi)) {
+      enabled.add(m[2].toLowerCase());
+    }
+  }
+  for (const [table, where] of created) {
+    if (!enabled.has(table)) add("sql-rls-missing", where.file, where.line, table);
+  }
+}
+
+export function detectSupabase(dir, files) {
+  if (files.some((f) => f.startsWith("supabase/"))) return true;
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(dir, "package.json"), "utf8"));
+    if (JSON.stringify({ ...pkg.dependencies, ...pkg.devDependencies }).includes("supabase")) return true;
+  } catch {
+    /* no package.json */
+  }
+  try {
+    if (/supabase/i.test(fs.readFileSync(path.join(dir, "requirements.txt"), "utf8"))) return true;
+  } catch {
+    /* no requirements.txt */
+  }
+  return false;
+}