auditai-scan 0.6.0 → 0.6.1

package/dist/auditai-scan.mjs

@@ -959,8 +959,23 @@ function secretScopeFor(fn, sf) {
   growNames(ownDeclarations(fn), scope);
   return scope;
 }
+var STORED_SECRET_FIELD = /(^|_)(secret|signing_key|api_key|key_hash|token_hash|hmac_key)$/;
+function readsStoredSecret(e) {
+  let hit = false;
+  const visit = (n) => {
+    if (hit) return;
+    if (ts3.isPropertyAccessExpression(n) && STORED_SECRET_FIELD.test(n.name.text.toLowerCase())) {
+      hit = true;
+      return;
+    }
+    n.forEachChild(visit);
+  };
+  visit(e);
+  return hit;
+}
 function isSecretish(e, scope) {
   if (envNamesIn(e).some(isSecretEnvName)) return true;
+  if (readsStoredSecret(e)) return true;
   for (const id of identifiersIn(e)) if (scope.names.has(id)) return true;
   let calls = false;
   const visit = (n) => {
@@ -984,7 +999,7 @@ var EQUALITY = /* @__PURE__ */ new Set([
   ts3.SyntaxKind.EqualsEqualsToken,
   ts3.SyntaxKind.ExclamationEqualsToken
 ]);
-var COMPARE_CALLEE = /^(timingSafeEqual|safeCompare|secureCompare|safeEqual|constantTimeEqual|constantTimeCompare|timingSafeCompare|compare|compareSync|isEqual|equals?)$/i;
+var COMPARE_CALLEE = /^(timingSafeEqual|safeCompare|secureCompare|safeEqual|constantTimeEqual|constantTimeCompare|timingSafeCompare|compare|compareSync|isEqual|equals?|secretsMatch|secretMatch|matchesSecret|tokensMatch|tokenMatches|sameSecret|checkSecret|validSecret|isValidSecret)$/i;
 var VERIFY_CALLEE = /^(verify|verifySync|jwtVerify|constructEvent|constructEventAsync|verifySignature|verifyWebhook|validateSignature)$/i;
 var THROWING_VERIFIER = /^(jwtVerify|constructEvent|constructEventAsync)$/;
 var THROWING_VERIFY_RECEIVER = /jwt|jose|jsonwebtoken/i;
@@ -1035,11 +1050,39 @@ function gates(node, fnBody) {
   }
   return false;
 }
+function receiverSecret(callee, secretish, builtFromSecret) {
+  if (!ts3.isPropertyAccessExpression(callee)) return false;
+  const recv = callee.expression;
+  if (ts3.isNewExpression(recv)) return (recv.arguments ?? []).some(secretish);
+  if (ts3.isIdentifier(recv) && builtFromSecret.has(recv.text)) return true;
+  return secretish(recv);
+}
+function instancesBuiltFromSecret(body, secretish) {
+  const out = /* @__PURE__ */ new Set();
+  for (const d of collect(body, ts3.isVariableDeclaration)) {
+    if (!d.initializer || !ts3.isIdentifier(d.name) || !ts3.isNewExpression(d.initializer)) continue;
+    if ((d.initializer.arguments ?? []).some(secretish)) out.add(d.name.text);
+  }
+  return out;
+}
+function gatesByThrow(node, fnBody) {
+  let child = node;
+  let cur = node.parent;
+  while (cur && cur !== fnBody && !isFunctionLikeNode(cur)) {
+    if (ts3.isTryStatement(cur) && cur.tryBlock === child && cur.catchClause) {
+      return exitKind(cur.catchClause.block) !== null;
+    }
+    child = cur;
+    cur = cur.parent;
+  }
+  return false;
+}
 function secretChecksIn(fn, sf) {
   if (!fn.body) return [];
   const body = fn.body;
   const secrets = secretScopeFor(fn, sf);
   const secretish = (e) => isSecretish(e, secrets);
+  const builtFromSecret = instancesBuiltFromSecret(body, secretish);
   const out = [];
   const push = (n) => {
     out.push({ node: n, text: n.getText(sf).replace(/\s+/g, " ").slice(0, 160) });
@@ -1058,8 +1101,9 @@ function secretChecksIn(fn, sf) {
     const verify = VERIFY_CALLEE.test(name);
     if (!compare && !verify) return;
     const secretArgs = n.arguments.filter(secretish).length;
-    if (secretArgs === 0 || secretArgs === n.arguments.length) return;
-    if (verify && throwsOnBadCredential(n) || gates(n, body)) push(n);
+    const receiverHoldsSecret = verify && receiverSecret(n.expression, secretish, builtFromSecret);
+    if (!receiverHoldsSecret && (secretArgs === 0 || secretArgs === n.arguments.length)) return;
+    if (verify && throwsOnBadCredential(n) || gates(n, body) || gatesByThrow(n, body)) push(n);
   });
   return out;
 }
@@ -1086,7 +1130,7 @@ function nextAuthSessionNames(stmt, nextAuthLocal) {
   }
   return out;
 }
-var CREDENTIAL_COLUMN = /(keyhash|tokenhash|hashedkey|hashedtoken|secrethash|apikey|apikeyhash|apitoken|accesstoken|sessiontoken|secret)$/;
+var CREDENTIAL_COLUMN = /(keyhash|tokenhash|hashedkey|hashedtoken|secrethash|apikey|apikeyhash|apitoken|accesstoken|sessiontoken|secret|token|sessioncode|invitecode|accesscode|sharecode)$/;
 function isCredentialColumn(column) {
   return column !== null && CREDENTIAL_COLUMN.test(column.toLowerCase().replace(/_/g, ""));
 }
@@ -3838,10 +3882,20 @@ var LOGICAL = /* @__PURE__ */ new Set([
   ts10.SyntaxKind.BarBarToken,
   ts10.SyntaxKind.AmpersandAmpersandToken
 ]);
+var SCHEMA_PARSE = /^(parse|safeParse|parseAsync|safeParseAsync)$/;
+function isSchemaParse(call, cx) {
+  const callee = call.expression;
+  if (!ts10.isPropertyAccessExpression(callee) || !SCHEMA_PARSE.test(callee.name.text)) return false;
+  const recv = callee.expression;
+  if (isWholeInput(recv, cx)) return false;
+  return cx.strippingSchema(recv);
+}
 function isWholeInput(e, cx) {
   const u = unwrap(e);
   if (ts10.isIdentifier(u)) return cx.wholeName(u.text);
   if (ts10.isPropertyAccessExpression(u) || ts10.isElementAccessExpression(u)) {
+    const inner = unwrap(u.expression);
+    if (ts10.isCallExpression(inner) && isSchemaParse(inner, cx)) return false;
     return isWholeInput(u.expression, cx);
   }
   if (ts10.isObjectLiteralExpression(u)) {
@@ -3861,6 +3915,7 @@ function isWholeInput(e, cx) {
 }
 function isWholeCall(call, cx) {
   if (cx.requestBody(call)) return true;
+  if (isSchemaParse(call, cx)) return false;
   const callee = call.expression;
   if (ts10.isPropertyAccessExpression(callee)) {
     const method = callee.name.text;
@@ -3882,7 +3937,8 @@ function callbackKeepsWhole(cb, receiverWhole, cx) {
   const inner = {
     wholeName: (n) => elementNames.has(n) || cx.wholeName(n),
     requestBody: cx.requestBody,
-    requestName: cx.requestName
+    requestName: cx.requestName,
+    strippingSchema: cx.strippingSchema
   };
   return ownReturns(f).some((r) => isWholeInput(r, inner));
 }
@@ -4207,6 +4263,7 @@ function usesInput(frame, e) {
   });
   return hit;
 }
+var CALLER_READ = /\b(?:await\s+)?cookies\(\)\s*(?:\.|$)|cookieStore\s*\.\s*get\s*\(|\bcookies\s*\.\s*get\s*\(|\b(?:await\s+)?headers\(\)\s*\.\s*get\s*\(/;
 var REQUEST_MEMBER = /^(json|formData|text|arrayBuffer|blob|body|headers|cookies|url|nextUrl|query|params|ip|geo)$/;
 var REQUEST_CLIENT_CALLEE = /client|supabase|prisma|drizzle/i;
 function handsOverRequest(frame, call) {
@@ -4275,13 +4332,28 @@ function isRequestBodyCall(frame, call) {
   if (frame.reqNames.has(recv.text)) return true;
   return frame.depth === 0 && frame.reqNames.size === 0 && REQUEST_NAME.test(recv.text);
 }
-function wholeContext(frame) {
+function wholeContext(p, frame) {
   return {
     wholeName: (n) => frame.wholeNames.has(n),
     requestBody: (c) => isRequestBodyCall(frame, c),
-    requestName: (n) => frame.reqNames.has(n)
+    requestName: (n) => frame.reqNames.has(n),
+    strippingSchema: (e) => isStrippingSchema(p, frame, e)
   };
 }
+var OBJECT_SCHEMA = /\b(?:z|zod|v|valibot|yup)\s*\.\s*object\s*\(/;
+var SCHEMA_KEEPS_UNKNOWN = /\.\s*(?:passthrough|catchall|nonstrict|unknown)\s*\(/;
+function isStrippingSchema(p, frame, e) {
+  const u = unwrap(e);
+  if (ts11.isCallExpression(u) || ts11.isPropertyAccessExpression(u)) {
+    const text2 = u.getText();
+    return OBJECT_SCHEMA.test(text2) && !SCHEMA_KEEPS_UNKNOWN.test(text2);
+  }
+  if (!ts11.isIdentifier(u)) return false;
+  const sym = scopeOf(p, frame.facts).get(u.text);
+  if (sym?.kind !== "var") return false;
+  const text = sym.init.getText();
+  return OBJECT_SCHEMA.test(text) && !SCHEMA_KEEPS_UNKNOWN.test(text);
+}
 function receiverTainted(frame, call) {
   const callee = call.expression;
   if (!ts11.isPropertyAccessExpression(callee) && !ts11.isElementAccessExpression(callee)) return false;
@@ -4336,7 +4408,7 @@ function argBinding(p, arg, frame) {
     client,
     instance,
     tainted: derivedIn(frame, arg),
-    whole: isWholeInput(arg, wholeContext(frame)),
+    whole: isWholeInput(arg, wholeContext(p, frame)),
     isRequest
   };
 }
@@ -4466,6 +4538,11 @@ function bindDeclarations(p, frame, acc) {
         continue;
       }
     }
+    if (CALLER_READ.test(text)) {
+      if (frame.depth === 0) handlerInput("header", names, decl);
+      else bindInput(names, false);
+      continue;
+    }
     if (ts11.isCallExpression(init)) {
       const inst = instanceOfCall(p, init, frame, scope);
       if (inst && ts11.isIdentifier(decl.name)) {
@@ -4478,7 +4555,7 @@ function bindDeclarations(p, frame, acc) {
       if (args.some((a) => a.tainted || a.isRequest) || receiverTainted(frame, init)) {
         const rt = returnTaint(p, init, frame, scope, 0);
         if (rt === null || rt.tainted && rt.props === null) {
-          bindInput(names, isWholeInput(init, wholeContext(frame)));
+          bindInput(names, isWholeInput(init, wholeContext(p, frame)));
         } else if (rt.tainted && rt.props !== null) {
           if (ts11.isIdentifier(decl.name))
             frame.partialInputs.set(decl.name.text, new Set(rt.props));
@@ -4515,7 +4592,7 @@ function bindDeclarations(p, frame, acc) {
         } else if (partial) bindPatternFrom(frame, decl.name, partial);
       }
     } else if (!isChainWithQuery(init) && derivedIn(frame, init)) {
-      bindInput(names, isWholeInput(init, wholeContext(frame)));
+      bindInput(names, isWholeInput(init, wholeContext(p, frame)));
     }
   }
   if (frame.depth === 0) {
@@ -4619,7 +4696,7 @@ function analyzeFrame(p, frame, acc) {
   const payloadOf = (arg) => arg ? {
     text: arg.getText(sf).replace(/\s+/g, " ").slice(0, 200),
     inputDerived: derivedIn(frame, arg),
-    wholeInput: isWholeInput(arg, wholeContext(frame))
+    wholeInput: isWholeInput(arg, wholeContext(p, frame))
   } : null;
   const storageHandles = storageBindingsIn(body);
   let callerScope = null;
@@ -4864,7 +4941,7 @@ function childFrame(p, call, target, frame) {
     pathPos: [...frame.pathPos, call.getStart(frame.sf)],
     exitPropagates: frame.exitPropagates && callResultChecked(call)
   };
-  const cx = wholeContext(frame);
+  const cx = wholeContext(p, frame);
   target.fn.parameters.forEach((param, i) => {
     const arg = call.arguments[i];
     const ab = argBinding(p, arg, frame);
@@ -5157,6 +5234,51 @@ function calleePath(e) {
   if (ts11.isElementAccessExpression(u)) return `${calleePath(u.expression)}[]`;
   return "";
 }
+var EMPTY_GUARDS = { authChecks: [], roleChecks: [] };
+function layoutGuards(p, pageRel, cache) {
+  const parts = pageRel.split("/");
+  parts.pop();
+  const out = { authChecks: [], roleChecks: [] };
+  for (let i = parts.length; i > 0; i--) {
+    const g = layoutGuardsFor(p, parts.slice(0, i).join("/"), cache);
+    out.authChecks.push(...g.authChecks);
+    out.roleChecks.push(...g.roleChecks);
+  }
+  return out;
+}
+var LAYOUT_EXTENSIONS = ["tsx", "ts", "jsx", "js"];
+function layoutGuardsFor(p, dir, cache) {
+  const hit = cache.get(dir);
+  if (hit) return hit;
+  let guards = EMPTY_GUARDS;
+  for (const ext of LAYOUT_EXTENSIONS) {
+    const rel = `${dir}/layout.${ext}`;
+    const sf = p.sources.get(rel);
+    const facts = p.registry.get(rel);
+    if (!sf || !facts || isClientComponentFile(sf)) continue;
+    const fn = pageHandlerIn(sf);
+    if (!fn) continue;
+    try {
+      const analysed = analyzeHandler(p, {
+        rel,
+        sf,
+        facts,
+        kind: "page",
+        route: dir,
+        method: "PAGE",
+        fn: fn.fn,
+        node: fn.node,
+        wrapper: fn.wrapper
+      });
+      guards = { authChecks: analysed.authChecks, roleChecks: analysed.roleChecks ?? [] };
+    } catch {
+      guards = EMPTY_GUARDS;
+    }
+    break;
+  }
+  cache.set(dir, guards);
+  return guards;
+}
 function analyzeHandler(p, h) {
   const { rel, sf, fn } = h;
   const loc2 = (n) => ({ file: rel, line: lineOf(sf, n) });
@@ -5365,6 +5487,15 @@ function parseProject(rootInput, opts = {}) {
     storageBuckets: schema.storageBuckets
   };
 }
+var LAYOUT_CACHE = /* @__PURE__ */ new WeakMap();
+function layoutCacheOf(p) {
+  let m = LAYOUT_CACHE.get(p);
+  if (!m) {
+    m = /* @__PURE__ */ new Map();
+    LAYOUT_CACHE.set(p, m);
+  }
+  return m;
+}
 function analyzeFile(project, rel, sf, facts, out) {
   const { routes, exposures, fileIgnores } = out;
   {
@@ -5423,6 +5554,11 @@ function analyzeFile(project, rel, sf, facts, out) {
           node: handler.node,
           wrapper: handler.wrapper
         });
+        const guards = layoutGuards(project, rel, layoutCacheOf(project));
+        analysed.authChecks.push(...guards.authChecks);
+        if (guards.roleChecks.length > 0) {
+          analysed.roleChecks = [...analysed.roleChecks ?? [], ...guards.roleChecks];
+        }
         if (analysed.queries.length > 0 || analysed.inputs.length > 0) routes.push(analysed);
       }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auditai-scan",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Deterministic security scanner for Next.js + Supabase apps: cross-tenant reads, RLS gaps, service-role misuse, mass assignment. No account, no model, seconds.",
   "license": "Apache-2.0",
   "type": "module",