canship 0.3.1 → 0.3.2

package/README-zh-CN.md

@@ -22,10 +22,10 @@ npx canship .
 | Git 跟踪及历史 `.env` 文件中的凭据或疑似私密值 | P0 |
 | Supabase 迁移记录中未启用行级安全（RLS）的表 | P1 |
 | Firebase 无条件访问及固定日期测试规则 | P1 |
-| Next.js API 数据操作未识别到鉴权 | P0 / P1 |
+| 服务端路由数据操作未识别到鉴权 | P0 / P1 |
 | 携带凭据的 CORS 来源回显或通配符配置 | P1 / P2 |
 
-支持 OpenAI、Anthropic、AWS、Stripe、GitHub、npm、Slack、SendGrid 等凭据格式及常见前端公开环境变量前缀。API 鉴权检查仅覆盖 Next.js `/api`，支持 App Router、Pages Router、路由组和工作区应用。
+支持 OpenAI、Anthropic、AWS、Stripe、GitHub、npm、Slack、SendGrid 等凭据格式及常见前端公开环境变量前缀。API 鉴权检查覆盖以下框架的服务端路由：Next.js（App Router 与 Pages Router 的 `/api`）、SvelteKit（`+server` 端点）、Nuxt（`server/api` 与 `server/routes`）、Remix 与 React Router（`app/routes` 中导出 `loader` 或 `action` 的模块）、Astro（`src/pages` 中的端点），支持路由组和工作区应用。不检查 SvelteKit 的页面 load 与表单 action。SvelteKit `hooks.server` 或 Nuxt `server/middleware` 中的鉴权会降低结果置信度而不是直接隐藏结果，因为它覆盖哪些路由由代码决定。
 
 置信度分为确定（`certain`）和疑似（`likely`），仅描述静态证据，不验证凭据有效性或线上状态。默认只展示确定结果；隐藏的疑似结果仍影响退出码。
 
@@ -75,7 +75,7 @@ JSON 使用独立于包版本的 `schemaVersion: 1`，npm 包附带 [结构定
 
 保存为 `.github/workflows/canship.yml`，在推送和 PR 时扫描并生成统计摘要。安装扫描器需要联网，扫描不联网；不安装或执行项目依赖，默认不上传 SARIF。
 
-示例固定 Action 提交，显式安装 npm 版 `0.3.0`；`version` 不使用仓库中的未发布源码。Action 兼容 0.2.1 无 `schemaVersion` 的报告。
+示例固定 Action 提交，显式安装 npm 版 `0.3.1`；`version` 不使用仓库中的未发布源码。Action 兼容 0.2.1 无 `schemaVersion` 的报告。
 
 ```yaml
 name: canship
@@ -90,15 +90,15 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: Tasomei/canship@8b1a3aa88c77e92e2806b343af6003372855bc70
+      - uses: Tasomei/canship@2d33cce0ad8439e34f01f5218fdaaf4657215e3d
         with:
-          version: '0.3.0'
+          version: '0.3.1'
 ```
 
 | 输入 | 默认值 | 说明 |
 |---|---|---|
 | `path` | `.` | 检出目录内的扫描路径 |
-| `version` | `0.3.0` | 精确 npm 版本，不接受范围或标签 |
+| `version` | `0.3.1` | 精确 npm 版本，不接受范围或标签 |
 | `fail-on` | `blocking` | `blocking`：确定的 P0/P1；`any`：全部结果；`none`：仅报告结果 |
 | `only` / `skip` | 未设置 | 互斥，逗号分隔的规则选择器 |
 | `baseline` | 未设置 | 相对扫描目录的已有基线 |

package/README.md

@@ -22,10 +22,10 @@ Requires Node.js ≥18; no runtime dependencies. `npx` may download the package;
 | Credentials or suspected private values in Git-tracked and historical `.env` files | P0 |
 | Supabase tables without Row Level Security (RLS) in migrations | P1 |
 | Firebase unconditional access and date-based test rules | P1 |
-| Next.js API data operations without recognised authentication | P0 / P1 |
+| Server route data operations without recognised authentication | P0 / P1 |
 | Credentialed CORS with reflected or wildcard origins | P1 / P2 |
 
-Supports OpenAI, Anthropic, AWS, Stripe, GitHub, npm, Slack, SendGrid, and other credential formats, plus common frontend public environment prefixes. API authentication checks cover only Next.js `/api`: App Router, Pages Router, route groups, and workspace applications.
+Supports OpenAI, Anthropic, AWS, Stripe, GitHub, npm, Slack, SendGrid, and other credential formats, plus common frontend public environment prefixes. API authentication checks cover server routes in Next.js (`/api` in the App and Pages Router), SvelteKit (`+server` endpoints), Nuxt (`server/api` and `server/routes`), Remix and React Router (modules in `app/routes` exporting `loader` or `action`), and Astro (endpoints in `src/pages`), including route groups and workspace applications. SvelteKit page loads and form actions are not checked. An authentication check in SvelteKit `hooks.server` or Nuxt `server/middleware` lowers confidence instead of suppressing findings, because the routes it covers are decided in code.
 
 Confidence is `certain` or `likely`, describing static evidence rather than credential validity or deployed state. Only certain findings are shown by default; hidden likely findings still affect the exit code.
 
@@ -75,7 +75,7 @@ JSON uses `schemaVersion: 1`, independent of the package version; the npm packag
 
 Save as `.github/workflows/canship.yml` to scan on pushes and pull requests, with a counts-only summary. Scanner installation requires network access; scanning does not. Project dependencies are not installed or executed, and SARIF upload is disabled by default.
 
-The example pins the Action commit and explicitly installs npm version `0.3.0`; `version` does not use unreleased repository source. The Action accepts 0.2.1 reports without `schemaVersion`.
+The example pins the Action commit and explicitly installs npm version `0.3.1`; `version` does not use unreleased repository source. The Action accepts 0.2.1 reports without `schemaVersion`.
 
 ```yaml
 name: canship
@@ -90,15 +90,15 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: Tasomei/canship@8b1a3aa88c77e92e2806b343af6003372855bc70
+      - uses: Tasomei/canship@2d33cce0ad8439e34f01f5218fdaaf4657215e3d
         with:
-          version: '0.3.0'
+          version: '0.3.1'
 ```
 
 | Input | Default | Meaning |
 |---|---|---|
 | `path` | `.` | Directory within the checkout |
-| `version` | `0.3.0` | Exact npm version; no ranges or tags |
+| `version` | `0.3.1` | Exact npm version; no ranges or tags |
 | `fail-on` | `blocking` | `blocking`: certain P0/P1; `any`: all findings; `none`: findings only reported |
 | `only` / `skip` | unset | Mutually exclusive, comma-separated rule selectors |
 | `baseline` | unset | Existing baseline relative to the scanned directory |

package/dist/cli.js

@@ -2301,25 +2301,69 @@ var firebaseRulesRule = {
 import { posix } from "path";
 var APP_ROUTER = /(?:^|\/)app\/api\/(?:.+\/)?route\.[mc]?[jt]sx?$/;
 var PAGES_ROUTER = /(?:^|\/)pages\/api\/.+\.[mc]?[jt]sx?$/;
-function isApiRoute(path) {
-  return APP_ROUTER.test(routePathOf(path)) || PAGES_ROUTER.test(path);
-}
+var SVELTEKIT_ENDPOINT = /^(.*?\/)?src\/routes\/(?:(.*)\/)?\+server\.[mc]?[jt]s$/;
+var NUXT_ROUTE = /^(.*?\/)?server\/(api|routes)\/(.+)\.[mc]?[jt]s$/;
+var H3_HANDLER = /\b(?:defineEventHandler|eventHandler|defineCachedEventHandler|defineLazyEventHandler)\s*\(/;
+var NUXT_METHOD_SUFFIX = /\.(?:get|post|put|patch|delete|head|options|connect|trace)$/i;
+var REMIX_ROUTE = /^(.*?\/)?app\/routes\/(.+)\.[mc]?[jt]sx?$/;
+var REMIX_EXPORT = /\bexport\s+(?:async\s+)?function\s+(?:loader|action)\b|\bexport\s+const\s+(?:loader|action)\b/;
+var ASTRO_ENDPOINT = /^(.*?\/)?src\/pages\/(.+)\.[mc]?[jt]s$/;
+var ASTRO_EXPORT = /\bexport\s+(?:async\s+)?function\s+(?:GET|POST|PUT|PATCH|DELETE|ALL)\b|\bexport\s+const\s+(?:GET|POST|PUT|PATCH|DELETE|ALL)\b/;
 function routePathOf(path) {
   return path.replace(/(^|\/)\([^/]+\)(?=\/)/g, "$1").replace(/\/{2,}/g, "/");
 }
-var AUTH_ENDPOINT_NAMES = /^\/api\/auth\/(?:sign[-_]?in|sign[-_]?up|sign[-_]?out|log[-_]?in|log[-_]?out|register|session|verify|confirm|reset(?:[-_]password)?|forgot(?:[-_]password)?|magic[-_]?link|otp)$/;
-var AUTH_CALLBACK = /^\/api\/auth\/callback(?:\/[^/]+)?$/;
-function isAuthEndpoint(url) {
-  return AUTH_ENDPOINT_NAMES.test(url) || AUTH_CALLBACK.test(url);
+function routeOf(file) {
+  const path = routePathOf(file.path);
+  if (APP_ROUTER.test(path) || PAGES_ROUTER.test(file.path)) {
+    const scope = /^(.*?)(?:src\/)?(?:app|pages)\/api\//.exec(path)?.[1] ?? "";
+    return { file, framework: "next", url: nextRouteUrl(path), scope };
+  }
+  const svelte = SVELTEKIT_ENDPOINT.exec(path);
+  if (svelte) return { file, framework: "sveltekit", url: `/${svelte[2] ?? ""}`, scope: svelte[1] ?? "" };
+  const nuxt = NUXT_ROUTE.exec(path);
+  if (nuxt && H3_HANDLER.test(noiseMaskedOf(file))) {
+    const rest = nuxt[3].replace(NUXT_METHOD_SUFFIX, "").replace(/(?:^|\/)index$/, "");
+    const url = nuxt[2] === "api" ? `/api/${rest}` : `/${rest}`;
+    return { file, framework: "nuxt", url: url.replace(/\/$/, "") || "/", scope: nuxt[1] ?? "" };
+  }
+  const remix = REMIX_ROUTE.exec(path);
+  if (remix && REMIX_EXPORT.test(noiseMaskedOf(file))) {
+    return { file, framework: "remix", url: remixRouteUrl(remix[2]), scope: remix[1] ?? "" };
+  }
+  const astro = ASTRO_ENDPOINT.exec(path);
+  if (astro && ASTRO_EXPORT.test(noiseMaskedOf(file))) {
+    const rest = astro[2].replace(/(?:^|\/)index$/, "");
+    return { file, framework: "astro", url: `/${rest}`, scope: astro[1] ?? "" };
+  }
+  return null;
 }
-function routeUrl(path) {
-  const m = /(?:^|\/)(?:app|pages)\/(api\/.*)$/.exec(routePathOf(path));
+function nextRouteUrl(path) {
+  const m = /(?:^|\/)(?:app|pages)\/(api\/.*)$/.exec(path);
   if (!m) return `/${path}`;
   const url = m[1].replace(/\/route\.[mc]?[jt]sx?$/, "").replace(/\/index\.[mc]?[jt]sx?$/, "").replace(/\.[mc]?[jt]sx?$/, "");
   return `/${url}`;
 }
-var AUTH_ENFORCING_CALL = /\b(?:NextAuth|require(?:Auth|User|Session|Admin)|withAuth|verifyAuth|ensureAuth|assertAuth(?:enticated)?|verifyIdToken|constructEvent)\s*\(/i;
-var AUTH_CONDITION = /\b(?:session|token|user|authorization|bearer|jwt|auth|signature|CRON_SECRET|WEBHOOK_SECRET|REVALIDATE_SECRET|ADMIN_SECRET)\b|\blocals\s*\.\s*user\b|\b(?:getUser|getSession|getServerSession|currentUser|getAuth|isAuthenticated|checkAuth|verifyAuth|ensureAuth|verifyIdToken|timingSafeEqual)\s*\(/i;
+function remixRouteUrl(name) {
+  const LITERAL_DOT = "\0";
+  const segments = name.replace(/\/route$/, "").replace(/\[\.\]/g, LITERAL_DOT).split(/[./]/).filter((segment) => segment !== "" && !segment.startsWith("_")).map((segment) => segment.replace(/_$/, "").replace(/[[\]]/g, "").split(LITERAL_DOT).join("."));
+  if (segments[segments.length - 1] === "index") segments.pop();
+  return `/${segments.join("/")}`;
+}
+var AUTH_ENDPOINT_NAMES = /^(?:\/api)?\/auth\/(?:sign[-_]?in|sign[-_]?up|sign[-_]?out|log[-_]?in|log[-_]?out|register|session|verify|confirm|reset(?:[-_]password)?|forgot(?:[-_]password)?|magic[-_]?link|otp)$/;
+var AUTH_CALLBACK = /^(?:\/api)?\/auth\/callback(?:\/[^/]+)?$/;
+var PROVIDER_CALLBACK = /^(?:\/api)?\/(?:auth|oauth|login|sign-?in)\/[^/]+\/callback$/;
+var OAUTH_HANDLER = /\bdefineOAuth\w*EventHandler\s*\(/;
+function isAuthEndpoint(route) {
+  return AUTH_ENDPOINT_NAMES.test(route.url) || AUTH_CALLBACK.test(route.url) || PROVIDER_CALLBACK.test(route.url) || OAUTH_HANDLER.test(noiseMaskedOf(route.file));
+}
+var AUTH_ENFORCING_CALL = /\b(?:NextAuth|require(?:Auth|User|Session|Admin)\w*|withAuth|verifyAuth|ensureAuth|assertAuth(?:enticated)?|verifyIdToken|constructEvent)\s*\(/i;
+var AUTH_CONDITION = /\b(?:session|token|user|userid|user_id|authorization|bearer|jwt|auth|signature|CRON_SECRET|WEBHOOK_SECRET|REVALIDATE_SECRET|ADMIN_SECRET)\b|\blocals\s*\.\s*user\b|\b(?:getUser|getSession|getServerSession|currentUser|getAuth|isAuthenticated|checkAuth|verifyAuth|ensureAuth|verifyIdToken|timingSafeEqual)\s*\(/i;
+var ACCESS_CHAIN = String.raw`[\w$]+(?:\??\.[\w$]+)*`;
+var NEGATED_IDENTITY = new RegExp(`^!\\s*${ACCESS_CHAIN}(?:\\s*\\([^=]*\\))?$`);
+var IDENTITY_IS_EMPTY = new RegExp(`^${ACCESS_CHAIN}\\s*={2,3}\\s*(?:null|undefined|false)$`);
+var IDENTITY_MISMATCH = new RegExp(`^${ACCESS_CHAIN}\\s*!={1,2}\\s*(?!(?:null|undefined|false)\\b)${ACCESS_CHAIN}$`);
+var STOPS_REQUEST = /^(?:(?:return|throw|redirect|notFound)\b|error\s*\(\s*40[13]\b)/;
+var DENIED_STATUS = /\b(?:return|throw)\b[\s\S]{0,300}\bstatus(?:Code)?\s*[:(=]\s*(?:401|403)\b|\berror\s*\(\s*40[13]\b/i;
 function closingDelimiter(source, start, open, close) {
   let depth = 0;
   for (let i = start; i < source.length; i++) {
@@ -2343,6 +2387,10 @@ function controlledStatement(source, afterCondition) {
   const end = semicolon === -1 ? Math.min(source.length, start + 400) : Math.min(semicolon + 1, start + 400);
   return source.slice(start, end);
 }
+function rejectsMissingIdentity(term, returnsDeniedStatus) {
+  const rejects = NEGATED_IDENTITY.test(term) || IDENTITY_IS_EMPTY.test(term) || IDENTITY_MISMATCH.test(term);
+  return rejects && (AUTH_CONDITION.test(term) || returnsDeniedStatus);
+}
 function hasConditionalAuthGuard(code) {
   const starts = /\bif\s*\(/g;
   let match;
@@ -2356,7 +2404,7 @@ function hasConditionalAuthGuard(code) {
     const pairs = delimiterPairs(body);
     let stopsRequest = false;
     for (let i = 0; i < body.length; i++) {
-      if (/^(?:return|throw|redirect|notFound)\b/.test(body.slice(i, i + 16)) && (i === 0 || !/[\w$]/.test(body[i - 1]))) {
+      if (STOPS_REQUEST.test(body.slice(i, i + 16)) && (i === 0 || !/[\w$]/.test(body[i - 1]))) {
         stopsRequest = true;
         break;
       }
@@ -2368,19 +2416,55 @@ function hasConditionalAuthGuard(code) {
     while (/\s/.test(code[statementStart] ?? "")) statementStart++;
     starts.lastIndex = statementStart + statement.length;
     if (!stopsRequest) continue;
-    const returnsDeniedStatus = /\b(?:return|throw)\b[\s\S]{0,300}\bstatus\s*[:(=]\s*(?:401|403)\b/i.test(statement);
-    const negative = !/&&|\?/.test(condition) && condition.split("||").some((part) => {
-      const term = part.trim();
-      const rejects = /^!\s*[\w$.]+(?:\s*\([^=]*\))?$/.test(term) || /^[\w$.]+\s*={2,3}\s*(?:null|undefined|false)$/.test(term) || /^[\w$.]+\s*!={1,2}\s*(?!(?:null|undefined|false)\b)[\w$.]+$/.test(term);
-      return rejects && (AUTH_CONDITION.test(term) || returnsDeniedStatus);
-    });
+    const returnsDeniedStatus = DENIED_STATUS.test(statement);
+    const negative = !/&&|\?(?!\.)/.test(condition) && condition.split("||").some((part) => rejectsMissingIdentity(part.trim(), returnsDeniedStatus));
     if (negative) return true;
   }
   return false;
 }
+function containsConditionalAuthCheck(code) {
+  const pairs = delimiterPairs(code);
+  for (const match of code.matchAll(/\bif\s*\(/g)) {
+    const open = match.index + match[0].length - 1;
+    const close = pairs.get(open);
+    if (close === void 0) continue;
+    let start = close + 1;
+    while (/\s/.test(code[start] ?? "")) start++;
+    let bodyStart = start;
+    let bodyEnd;
+    if (code[start] === "{") {
+      bodyStart = start + 1;
+      bodyEnd = pairs.get(start) ?? Math.min(code.length, start + 600);
+    } else {
+      const semicolon = code.slice(start, start + 400).indexOf(";");
+      bodyEnd = semicolon === -1 ? Math.min(code.length, start + 400) : start + semicolon + 1;
+    }
+    let stop = -1;
+    for (let i = bodyStart; i < bodyEnd; i++) {
+      const window = code.slice(i, i + 16);
+      if (STOPS_REQUEST.test(window) && (i === 0 || !/[\w$]/.test(code[i - 1]))) {
+        stop = i;
+        break;
+      }
+      if (/^if\s*\(/.test(window)) break;
+      const end = pairs.get(i);
+      if (end !== void 0) i = end;
+    }
+    if (stop === -1) continue;
+    const returnsDeniedStatus = DENIED_STATUS.test(code.slice(stop, stop + 400));
+    const condition = code.slice(open + 1, close);
+    if (condition.split(/\|\||&&/).some((part) => rejectsMissingIdentity(part.trim(), returnsDeniedStatus))) return true;
+  }
+  return false;
+}
+var authSignalCache = /* @__PURE__ */ new WeakMap();
 function hasAuthSignal(file) {
+  const cached = authSignalCache.get(file);
+  if (cached !== void 0) return cached;
   const code = noiseMaskedOf(file);
-  return AUTH_ENFORCING_CALL.test(code) || hasConditionalAuthGuard(code);
+  const found = AUTH_ENFORCING_CALL.test(code) || hasConditionalAuthGuard(code);
+  authSignalCache.set(file, found);
+  return found;
 }
 function delimiterPairs(code) {
   const pairs = /* @__PURE__ */ new Map();
@@ -2508,7 +2592,7 @@ function unguardedOperations(file, ops) {
     return true;
   });
 }
-var CLIENT_CONSTRUCTOR = /\b(?:createClient|createServerClient)\s*(?:<[^()]{0,200}>)?\s*\(/;
+var CLIENT_CONSTRUCTOR = /\b(?:createClient|createServerClient)\s*(?:<[^()]{0,200}>\s*)?\(/;
 var SERVICE_ROLE_ENV = /\bSUPABASE_SERVICE_ROLE(?:_KEY)?\b|\bSERVICE_ROLE_KEY\b|\bSUPABASE_SECRET_KEY\b/;
 var SERVICE_ROLE_LITERAL = new RegExp(String.raw`['"\`](${JWT_SOURCE}|${SB_SECRET_SOURCE})['"\`]`, "g");
 var ENV_BRACKET_ACCESS = /(?:process\.env|import\.meta\.env)\s*\[\s*['"]([^'"]+)['"]\s*\]/g;
@@ -2521,8 +2605,11 @@ function referencesServiceRole(code, source) {
   }
   return false;
 }
+var NUXT_SUPABASE_ADMIN = /\bserverSupabaseServiceRole\s*(?:<[^()]{0,200}>\s*)?\(/;
+var NUXT_SUPABASE_SESSION = /\bserverSupabaseClient\s*(?:<[^()]{0,200}>\s*)?\(/;
 function buildsAdminClient(file) {
   const code = noiseMaskedOf(file);
+  if (NUXT_SUPABASE_ADMIN.test(code)) return true;
   if (!CLIENT_CONSTRUCTOR.test(code)) return false;
   const source = commentsMaskedOf(file);
   if (referencesServiceRole(code, source)) return true;
@@ -2535,6 +2622,8 @@ function buildsAdminClient(file) {
 }
 function buildsSessionClient(file) {
   const code = noiseMaskedOf(file);
+  if (NUXT_SUPABASE_ADMIN.test(code)) return false;
+  if (NUXT_SUPABASE_SESSION.test(code)) return true;
   if (!CLIENT_CONSTRUCTOR.test(code)) return false;
   if (referencesServiceRole(code, commentsMaskedOf(file))) return false;
   return /\bcookies\b/.test(code);
@@ -2564,17 +2653,29 @@ function normalizeSpec(spec, fromPath) {
       alias: false
     };
   }
-  const alias = /^[@~#]\/(.+)$/.exec(spec);
+  const lib = /^\$lib\/(.+)$/.exec(spec);
+  if (lib) return { key: moduleKey(`src/lib/${lib[1]}`), alias: true };
+  const alias = /^(?:[@~#]|~~|@@)\/(.+)$/.exec(spec);
   return alias ? { key: moduleKey(alias[1]), alias: true } : null;
 }
 function usesAdminClient(route, adminModules, allFiles) {
-  return buildsAdminClient(route) || importsAnyOf(route, adminModules, allFiles);
+  return buildsAdminClient(route.file) || importsAnyOf(route, adminModules, allFiles) || autoImportsAnyOf(route, adminModules);
 }
 function usesSessionClient(route, sessionModules, allFiles) {
-  return buildsSessionClient(route) || importsAnyOf(route, sessionModules, allFiles);
-}
-function moduleScopeOf(routePath) {
-  return /^(.*?)(?:src\/)?(?:app|pages)\/api\//.exec(routePathOf(routePath))?.[1] ?? "";
+  if (route.framework === "sveltekit" && /\blocals\s*\.\s*supabase\b/.test(noiseMaskedOf(route.file))) return true;
+  return buildsSessionClient(route.file) || importsAnyOf(route, sessionModules, allFiles) || autoImportsAnyOf(route, sessionModules);
+}
+function autoImportsAnyOf(route, modules) {
+  if (route.framework !== "nuxt") return false;
+  const utils = `${route.scope}server/utils/`;
+  const code = noiseMaskedOf(route.file);
+  return modules.some((module) => module.path.startsWith(utils) && exportedNames(module).some((name) => new RegExp(`(?<![\\w$.])${name.replace(/\$/g, "\\$")}\\s*\\(`).test(code)));
+}
+function exportedNames(file) {
+  const names = noiseMaskedOf(file).matchAll(
+    /\bexport\s+(?:async\s+)?(?:function\s*\*?\s*|const\s+|let\s+|var\s+)([A-Za-z_$][\w$]*)/g
+  );
+  return [...names].map((m) => m[1]);
 }
 function importedModules(file, allFiles, aliasScope) {
   const found = [];
@@ -2593,7 +2694,8 @@ function importedModules(file, allFiles, aliasScope) {
       const prefix = aliasScope;
       for (const key of [
         moduleKey(`${prefix}${target.key}`),
-        moduleKey(`${prefix}src/${target.key}`)
+        moduleKey(`${prefix}src/${target.key}`),
+        moduleKey(`${prefix}app/${target.key}`)
       ]) {
         found.push(...index.get(key) ?? []);
       }
@@ -2605,8 +2707,8 @@ function importsAnyOf(route, modules, allFiles) {
   if (modules.length === 0) return false;
   const targetPaths = new Set(modules.map((file) => file.path));
   const visited = /* @__PURE__ */ new Set();
-  const aliasScope = moduleScopeOf(route.path);
-  const queue = importedModules(route, allFiles, aliasScope);
+  const aliasScope = route.scope;
+  const queue = importedModules(route.file, allFiles, aliasScope);
   while (queue.length > 0) {
     const file = queue.pop();
     if (targetPaths.has(file.path)) return true;
@@ -2856,7 +2958,7 @@ function middlewareCovers(ctx, routePath, url) {
   const mw = middlewareFor(ctx, routePath);
   if (!mw) return false;
   if (!hasAuthSignal(mw)) return false;
-  const config = extractMatcherConfig(mw);
+  const { config, readable } = compiledMatchersOf(mw);
   if (config.kind === "absent") return true;
   if (config.kind === "unreadable") {
     ctx.reportIncomplete(
@@ -2865,11 +2967,39 @@ function middlewareCovers(ctx, routePath, url) {
     );
     return true;
   }
-  const parsed = config.patterns.map(matcherToRegex);
-  const readable = parsed.filter((re) => re !== null);
   if (readable.length === 0) return true;
   return readable.some((re) => re.test(url));
 }
+var matcherCache = /* @__PURE__ */ new WeakMap();
+function compiledMatchersOf(file) {
+  const cached = matcherCache.get(file);
+  if (cached !== void 0) return cached;
+  const config = extractMatcherConfig(file);
+  const readable = config.kind === "patterns" ? config.patterns.map(matcherToRegex).filter((re) => re !== null) : [];
+  const compiled = { config, readable };
+  matcherCache.set(file, compiled);
+  return compiled;
+}
+function globalGuardFor(ctx, route) {
+  const relative3 = (file) => file.path.startsWith(route.scope) ? file.path.slice(route.scope.length) : null;
+  const candidates = ctx.files.filter((file) => {
+    const path = relative3(file);
+    if (path === null) return false;
+    if (route.framework === "sveltekit") return /^src\/hooks\.server\.[mc]?[jt]s$/.test(path);
+    if (route.framework === "nuxt") return /^server\/middleware\/.+\.[mc]?[jt]s$/.test(path);
+    return false;
+  });
+  return candidates.find(containsAuthCheck)?.path ?? null;
+}
+var authCheckCache = /* @__PURE__ */ new WeakMap();
+function containsAuthCheck(file) {
+  const cached = authCheckCache.get(file);
+  if (cached !== void 0) return cached;
+  const code = noiseMaskedOf(file);
+  const found = AUTH_ENFORCING_CALL.test(code) || containsConditionalAuthCheck(code);
+  authCheckCache.set(file, found);
+  return found;
+}
 var SECRET_SHAPED = /['"`]([A-Za-z0-9_\-.]{32,})['"`]/g;
 function excerptFor(file, line) {
   const raw = (file.lines[line - 1] ?? "").trim();
@@ -2885,7 +3015,7 @@ var apiAuthRule = {
   id: "api/db-access-without-auth",
   severity: "P0",
   check(ctx) {
-    const routes = ctx.files.filter((f) => isApiRoute(f.path));
+    const routes = ctx.files.map(routeOf).filter((route) => route !== null);
     if (routes.length === 0) return [];
     for (const middlewareFile of ctx.files.filter((f) => MIDDLEWARE_FILE.test(f.path))) {
       const config = extractMatcherConfig(middlewareFile);
@@ -2901,26 +3031,31 @@ var apiAuthRule = {
     const sessionModules = ctx.files.filter(buildsSessionClient);
     const findings = [];
     for (const route of routes) {
-      const ops = unguardedOperations(route, findDataOps(route));
+      const ops = unguardedOperations(route.file, findDataOps(route.file));
       if (ops.length === 0) continue;
-      const url = routeUrl(route.path);
-      if (isAuthEndpoint(url)) continue;
-      if (middlewareCovers(ctx, route.path, url)) continue;
+      const url = route.url;
+      if (isAuthEndpoint(route)) continue;
+      if ((route.framework === "next" || route.framework === "astro") && middlewareCovers(ctx, route.file.path, url)) continue;
+      const globalGuard = globalGuardFor(ctx, route);
+      const globalNote = globalGuard === null ? [] : [
+        `${globalGuard} contains an authentication check that may cover ${url}. Its path conditions are written in code, so the scan cannot tell which routes it applies to; this finding is reported at lower confidence. Confirm that check runs for ${url}.`
+      ];
       const admin = usesAdminClient(route, adminModules, ctx.files);
       const hit = ops.find((o) => o.writes) ?? ops[0];
-      const line = lineNumberAt(lineStartsOf(route.content), hit.index);
-      const excerpt = excerptFor(route, line);
+      const line = lineNumberAt(lineStartsOf(route.file.content), hit.index);
+      const excerpt = excerptFor(route.file, line);
       if (admin) {
         findings.push({
           ruleId: "api/admin-db-access-without-auth",
           severity: "P0",
-          // 管理员客户端缺少鉴权时使用确定置信度。
-          confidence: "certain",
+          // 管理员客户端缺少鉴权时使用确定置信度；可能受全局鉴权覆盖时降为疑似。
+          confidence: globalGuard === null ? "certain" : "likely",
           title: `Anyone can call ${url} and it queries your database as admin`,
-          file: route.path,
+          file: route.file.path,
           line,
           excerpt,
           why: [
+            ...globalNote,
             `This route references a recognized admin client. Such clients can bypass normal per-user access checks; verify the effective credentials and granted permissions.`,
             `The scan did not recognize an authentication guard protecting this operation or applicable middleware. Indirect wrappers and deployment-level controls may not be recognized; verify them before exposing this route.`,
             `If ${url} is reachable without authentication, callers can trigger the admin-backed operations implemented by this handler.`,
@@ -2945,10 +3080,11 @@ var apiAuthRule = {
           // 公开写入可能是业务设计，保留疑似置信度。
           confidence: "likely",
           title: `${url} writes to your database with no sign-in check`,
-          file: route.path,
+          file: route.file.path,
           line,
           excerpt,
           why: [
+            ...globalNote,
             `This route changes data, and the scan did not recognize an authentication guard before the operation. Indirect guards and runtime controls require manual verification.`,
             `If this route is publicly reachable and no other control rejects the caller, unauthenticated requests can trigger this write.`,
             `If this is a public form \u2014 a waitlist, a contact box \u2014 that may be intentional. It is still worth rate limiting, because an open write endpoint is what gets a database filled with spam overnight.`
@@ -2992,7 +3128,7 @@ function headerExpression(content, start) {
   return content.slice(start, end);
 }
 var CORS_ORIGIN_OPTION = /\borigin\s*:\s*/gi;
-var CORS_ORIGIN_PROPERTY_START = /\borigin\s*:\s*(?:async\s+)?(?:(function)\s*(?:[A-Za-z_$][\w$]*)?\s*)?\(/gi;
+var CORS_ORIGIN_PROPERTY_START = /\borigin\s*:\s*(?:async\s+)?(?:(function)\s*(?:[A-Za-z_$][\w$]*\s*)?)?\(/gi;
 var CORS_ORIGIN_METHOD_START = /\borigin\s*\(/gi;
 function closingParameterList(source, open) {
   let depth = 0;
@@ -3114,8 +3250,14 @@ function callbackAnswer(params, body) {
 var ORIGIN_IS_CHECKED = /\bincludes\s*\(|\bindexOf\s*\(|===|!==|==|!=|\.test\s*\(|\.some\s*\(|\bstartsWith\s*\(|\.match\s*\(|\.has\s*\(|\bif\b|\?|\ballow(?:ed|list)?\b|\bwhitelist\b/i;
 var ACAC_HEADER = /['"]Access-Control-Allow-Credentials['"][\s\S]{0,40}?\btrue\b/gi;
 var CORS_CREDENTIALS_OPTION = /\bcredentials\s*:\s*true\b/g;
+var TRAILING_PUNCTUATION = /[\s;,)}\]!]/;
+function trimTrailingPunctuation(text) {
+  let end = text.length;
+  while (end > 0 && TRAILING_PUNCTUATION.test(text[end - 1])) end--;
+  return text.slice(0, end);
+}
 function classifyOrigin(raw) {
-  let v = raw.trim().replace(/[\s;,)}\]!]+$/, "");
+  let v = trimTrailingPunctuation(raw.trim());
   const opening = v[0];
   if (opening === '"' || opening === "'" || opening === "`") {
     const close = v.indexOf(opening, 1);
@@ -4510,15 +4652,15 @@ var RULE_CATALOG = [
     "Admin database access without a recognized auth guard",
     "P0",
     "certain",
-    "Next.js App/Pages API handlers, including workspace applications.",
-    "Syntactic guards only; runtime authentication and business authorization are not verified."
+    "Server routes in Next.js, SvelteKit, Nuxt, Remix/React Router, and Astro, including workspace applications.",
+    "Syntactic guards only; runtime authentication and business authorization are not verified. Guards in SvelteKit hooks or Nuxt server middleware lower confidence."
   ),
   rule(
     "api/db-write-without-auth",
     "Database write without a recognized auth guard",
     "P1",
     "likely",
-    "Next.js App/Pages API handlers.",
+    "Server routes in Next.js, SvelteKit, Nuxt, Remix/React Router, and Astro.",
     "Session-scoped clients and indirect guards may need manual review."
   ),
   rule(
@@ -4625,7 +4767,7 @@ function renderRuleCatalog() {
 }
 
 // src/cli.ts
-var VERSION = true ? "0.3.1" : "0.0.0-dev";
+var VERSION = true ? "0.3.2" : "0.0.0-dev";
 function finish(code) {
   process.exitCode = code;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "canship",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Static scanner for exposed credentials and open access rules in JS/TS front-end projects. Scans local files without executing project code or making network requests.",
   "keywords": [
     "security",