arckode-framework 1.4.0 → 1.4.2

package/cli/analyze/checks.ts

@@ -159,6 +159,7 @@ export async function checkConnectorLogic(
   for (const connFile of connectors) {
     try {
       const content = await readFile(join(connectorsPath, connFile), 'utf-8')
+      if (content.includes('@ignore CONNECTOR_BUSINESS_LOGIC')) continue
       let businessHits = 0
       for (const pattern of businessPatterns) {
         const matches = content.match(pattern)
@@ -287,6 +288,13 @@ export async function checkModuleQuality(
       } catch { /* no subdir */ }
     }
 
+    // Patrones que indican verificación de ownership (en ventana antes o después de findById)
+    const ownershipPatterns = [
+      'assertOwnership', 'assertPerteneceAlLocal', 'userId', 'ownerId',
+      'authUserId', 'currentUser', 'ForbiddenError', 'No es tu', 'No tenés',
+      'No pertenece', 'acceso a este',
+    ]
+
     for (const filePath of filesToScan) {
       if (/-orm\.ts$|-repo\.ts$|-repository\.ts$|repository\.ts$/.test(filePath)) continue
       try {
@@ -300,10 +308,19 @@ export async function checkModuleQuality(
           const closes = (line.match(/\}/g) ?? []).length
           if (insideInterface > 0) insideInterface = Math.max(0, insideInterface + opens - closes)
           if (insideInterface > 0) continue
-          if (/^\s*findById\s*\([^)]*\)\s*:/.test(line)) continue
+          if (/^\s*(async\s+)?findById\s*\([^)]*\)\s*:/.test(line)) continue
           if (/\bfindById\s*\(/.test(line)) {
-            const window = fileLines.slice(i + 1, i + 6).join('\n')
-            if (!window.includes('assertOwnership') && !window.includes('userId') && !window.includes('ownerId')) {
+            // @ignore IDOR_RISK — suppress false positives
+            if (line.includes('@ignore IDOR_RISK') || (i > 0 && fileLines[i - 1]?.includes('@ignore IDOR_RISK'))) continue
+
+            // Check 10 lines AFTER findById
+            const afterWindow = fileLines.slice(i + 1, i + 11).join('\n')
+            // Check 5 lines BEFORE findById (for pre-validation patterns like authContext checks)
+            const beforeWindow = fileLines.slice(Math.max(0, i - 5), i).join('\n')
+            const combinedWindow = beforeWindow + '\n' + afterWindow
+
+            const hasOwnership = ownershipPatterns.some(p => combinedWindow.includes(p))
+            if (!hasOwnership) {
               violations.push({ type: 'IDOR_RISK', module: module.name, message: `"${relative(modulesPath, filePath)}" línea ${i + 1}: findById sin verificación de ownership. Usar auth.assertOwnership() para prevenir IDOR.` })
               break
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arckode-framework",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "AI-first TypeScript/Bun framework. Modular, SOLID, zero magic. The AI reads the composition root and knows everything.",
   "type": "module",
   "main": "./kernel/framework.ts",