code-auditor-mcp 1.0.0

package/dist/analyzers/analyzerUtils.js

@@ -0,0 +1,188 @@
+/**
+ * Functional utilities for analyzer development
+ * These replace the BaseAnalyzer class with composable functions
+ */
+import * as ts from 'typescript';
+// Re-export utilities from other modules
+export { parseTypeScriptFile } from '../utils/astParser.js';
+export { getLineAndColumn, getNodeText, getImports, findNodesByKind } from '../utils/astUtils.js';
+/**
+ * Standard file processing function
+ * Handles file reading, parsing, error handling, and progress reporting
+ */
+export async function processFiles(files, analyzeFile, analyzerName, config = {}, progressReporter) {
+    const violations = [];
+    const errors = [];
+    let processedFiles = 0;
+    const startTime = Date.now();
+    for (const file of files) {
+        try {
+            // Report progress
+            if (progressReporter) {
+                progressReporter(processedFiles, files.length, file);
+            }
+            // Read and parse file
+            const { parseTypeScriptFile: parse } = await import('../utils/astParser.js');
+            const { sourceFile, errors: parseErrors } = await parse(file);
+            if (parseErrors.length > 0) {
+                throw new Error(`Parse errors: ${parseErrors.map(e => e.messageText).join(', ')}`);
+            }
+            // Run analyzer-specific logic
+            const fileViolations = await analyzeFile(file, sourceFile, config);
+            violations.push(...fileViolations);
+            processedFiles++;
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            errors.push({ file, error: errorMessage });
+            console.error(`Error analyzing ${file}:`, error);
+        }
+    }
+    const result = {
+        violations,
+        filesProcessed: processedFiles,
+        executionTime: Date.now() - startTime,
+        analyzerName
+    };
+    if (errors.length > 0) {
+        result.errors = errors;
+    }
+    return result;
+}
+/**
+ * Create a violation object with defaults
+ */
+export function createViolation(data) {
+    return data;
+}
+/**
+ * Get line and column from a TypeScript node
+ */
+export function getNodePosition(sourceFile, node) {
+    const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+    return { line: line + 1, column: character + 1 };
+}
+/**
+ * Check if a node is exported
+ */
+export function isNodeExported(node) {
+    if (ts.canHaveModifiers(node)) {
+        const modifiers = ts.getModifiers(node);
+        return !!modifiers?.some(m => m.kind === ts.SyntaxKind.ExportKeyword);
+    }
+    return false;
+}
+/**
+ * Get the name of a node if it has one
+ */
+export function getNodeName(node) {
+    if ('name' in node && node.name) {
+        const name = node.name;
+        if (ts.isIdentifier(name)) {
+            return name.text;
+        }
+    }
+    return undefined;
+}
+/**
+ * Count specific node types in a subtree
+ */
+export function countNodesOfType(node, predicate) {
+    let count = 0;
+    const visit = (node) => {
+        if (predicate(node)) {
+            count++;
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(node);
+    return count;
+}
+/**
+ * Find all nodes of a specific type
+ */
+export function findNodesOfType(node, predicate) {
+    const nodes = [];
+    const visit = (node) => {
+        if (predicate(node)) {
+            nodes.push(node);
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(node);
+    return nodes;
+}
+/**
+ * Traverse AST with a visitor function
+ */
+export function traverseAST(node, visitor) {
+    visitor(node);
+    ts.forEachChild(node, child => traverseAST(child, visitor));
+}
+/**
+ * Filter violations by severity
+ */
+export function filterViolationsBySeverity(violations, minSeverity) {
+    if (!minSeverity) {
+        return violations;
+    }
+    const severityOrder = { critical: 3, warning: 2, suggestion: 1 };
+    const minLevel = severityOrder[minSeverity] || 0;
+    return violations.filter(v => severityOrder[v.severity] >= minLevel);
+}
+/**
+ * Sort violations by severity, file, and line
+ */
+export function sortViolations(violations) {
+    return violations.sort((a, b) => {
+        // Sort by severity first
+        const severityOrder = { critical: 3, warning: 2, suggestion: 1 };
+        const severityDiff = severityOrder[b.severity] - severityOrder[a.severity];
+        if (severityDiff !== 0)
+            return severityDiff;
+        // Then by file
+        const fileDiff = a.file.localeCompare(b.file);
+        if (fileDiff !== 0)
+            return fileDiff;
+        // Then by line
+        return (a.line || 0) - (b.line || 0);
+    });
+}
+/**
+ * Calculate cyclomatic complexity of a function
+ */
+export function calculateComplexity(node) {
+    let complexity = 1;
+    traverseAST(node, (child) => {
+        if (ts.isIfStatement(child) ||
+            ts.isConditionalExpression(child) ||
+            ts.isSwitchStatement(child) ||
+            ts.isForStatement(child) ||
+            ts.isWhileStatement(child) ||
+            ts.isDoStatement(child) ||
+            ts.isCaseClause(child)) {
+            complexity++;
+        }
+        if (ts.isBinaryExpression(child)) {
+            const operator = child.operatorToken.kind;
+            if (operator === ts.SyntaxKind.AmpersandAmpersandToken ||
+                operator === ts.SyntaxKind.BarBarToken) {
+                complexity++;
+            }
+        }
+    });
+    return complexity;
+}
+/**
+ * Create a standard analyzer function
+ */
+export function createAnalyzer(name, fileAnalyzer, defaultConfig = {}) {
+    return async (files, config, options) => {
+        const mergedConfig = { ...defaultConfig, ...config };
+        const result = await processFiles(files, fileAnalyzer, name, mergedConfig);
+        // Apply filtering and sorting
+        result.violations = sortViolations(filterViolationsBySeverity(result.violations, options?.minSeverity));
+        return result;
+    };
+}
+//# sourceMappingURL=analyzerUtils.js.map

package/dist/analyzers/analyzerUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyzerUtils.js","sourceRoot":"","sources":["../../src/analyzers/analyzerUtils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAGjC,yCAAyC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,eAAe,EAChB,MAAM,sBAAsB,CAAC;AAgB9B;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAe,EACf,WAAiC,EACjC,YAAoB,EACpB,SAAc,EAAE,EAChB,gBAAmC;IAEnC,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,MAAM,MAAM,GAA2C,EAAE,CAAC;IAC1D,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,kBAAkB;YAClB,IAAI,gBAAgB,EAAE,CAAC;gBACrB,gBAAgB,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACvD,CAAC;YAED,sBAAsB;YACtB,MAAM,EAAE,mBAAmB,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAC7E,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YAE9D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,iBAAiB,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACrF,CAAC;YAED,8BAA8B;YAC9B,MAAM,cAAc,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YACnE,UAAU,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;YAEnC,cAAc,EAAE,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5E,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YAC3C,OAAO,CAAC,KAAK,CAAC,mBAAmB,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAmB;QAC7B,UAAU;QACV,cAAc,EAAE,cAAc;QAC9B,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QACrC,YAAY;KACb,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAe;IAEf,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,UAAyB,EACzB,IAAa;IAEb,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtF,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,GAAG,CAAC,EAAE,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,IAAa;IACvC,IAAI,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAuB,CAAC;QAC1C,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAa,EACb,SAAuC;IAEvC,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,MAAM,KAAK,GAAG,CAAC,IAAa,EAAE,EAAE;QAC9B,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,KAAK,EAAE,CAAC;QACV,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC;IAEF,KAAK,CAAC,IAAI,CAAC,CAAC;IACZ,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAa,EACb,SAAuC;IAEvC,MAAM,KAAK,GAAQ,EAAE,CAAC;IAEtB,MAAM,KAAK,GAAG,CAAC,IAAa,EAAE,EAAE;QAC9B,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC;IAEF,KAAK,CAAC,IAAI,CAAC,CAAC;IACZ,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CACzB,IAAa,EACb,OAAgC;IAEhC,OAAO,CAAC,IAAI,CAAC,CAAC;IACd,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAAuB,EACvB,WAA2B;IAE3B,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,aAAa,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;IACjE,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAEjD,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAC3B,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,QAAQ,CACtC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,UAAuB;IACpD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC9B,yBAAyB;QACzB,MAAM,aAAa,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QACjE,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3E,IAAI,YAAY,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC;QAE5C,eAAe;QACf,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QAEpC,eAAe;QACf,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAgC;IAClE,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;QAC1B,IACE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;YACvB,EAAE,CAAC,uBAAuB,CAAC,KAAK,CAAC;YACjC,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC;YAC3B,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC;YACxB,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC;YAC1B,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;YACvB,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,EACtB,CAAC;YACD,UAAU,EAAE,CAAC;QACf,CAAC;QAED,IAAI,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC;YAC1C,IACE,QAAQ,KAAK,EAAE,CAAC,UAAU,CAAC,uBAAuB;gBAClD,QAAQ,KAAK,EAAE,CAAC,UAAU,CAAC,WAAW,EACtC,CAAC;gBACD,UAAU,EAAE,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,YAAkC,EAClC,gBAAqB,EAAE;IAEvB,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;QACtC,MAAM,YAAY,GAAG,EAAE,GAAG,aAAa,EAAE,GAAG,MAAM,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;QAE3E,8BAA8B;QAC9B,MAAM,CAAC,UAAU,GAAG,cAAc,CAChC,0BAA0B,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,WAAW,CAAC,CACpE,CAAC;QAEF,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/analyzers/dataAccessAnalyzer.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Data Access Analyzer (Functional)
+ * Analyzes database access patterns and data layer interactions
+ *
+ * Detects database usage, query patterns, performance risks,
+ * and security concerns in data access code
+ */
+import { AnalyzerDefinition } from '../types.js';
+/**
+ * Configuration for Data Access analyzer
+ */
+export interface DataAccessAnalyzerConfig {
+    databases?: {
+        [key: string]: {
+            name: string;
+            importPatterns: string[];
+            queryPatterns: string[];
+            ormPatterns?: string[];
+        };
+    };
+    organizationPatterns?: string[];
+    tablePatterns?: {
+        orm?: RegExp[];
+        sql?: RegExp[];
+        queryBuilder?: RegExp[];
+    };
+    performanceThresholds?: {
+        complexQueryCount?: number;
+        unfilteredQueryCount?: number;
+        joinedTableCount?: number;
+    };
+    securityPatterns?: {
+        sqlInjectionRisks?: string[];
+        parameterizedQueries?: string[];
+    };
+    sourcePatterns?: {
+        api?: string[];
+        page?: string[];
+        service?: string[];
+    };
+}
+/**
+ * Data Access Analyzer definition
+ */
+export declare const dataAccessAnalyzer: AnalyzerDefinition;
+//# sourceMappingURL=dataAccessAnalyzer.d.ts.map

package/dist/analyzers/dataAccessAnalyzer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataAccessAnalyzer.d.ts","sourceRoot":"","sources":["../../src/analyzers/dataAccessAnalyzer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAIL,kBAAkB,EAEnB,MAAM,aAAa,CAAC;AAYrB;;GAEG;AACH,MAAM,WAAW,wBAAwB;IAEvC,SAAS,CAAC,EAAE;QACV,CAAC,GAAG,EAAE,MAAM,GAAG;YACb,IAAI,EAAE,MAAM,CAAC;YACb,cAAc,EAAE,MAAM,EAAE,CAAC;YACzB,aAAa,EAAE,MAAM,EAAE,CAAC;YACxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;SACxB,CAAC;KACH,CAAC;IAGF,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAGhC,aAAa,CAAC,EAAE;QACd,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QACf,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QACf,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IAGF,qBAAqB,CAAC,EAAE;QACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IAGF,gBAAgB,CAAC,EAAE;QACjB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC7B,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;KACjC,CAAC;IAGF,cAAc,CAAC,EAAE;QACf,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;CACH;AAygBD;;GAEG;AACH,eAAO,MAAM,kBAAkB,EAAE,kBA8BhC,CAAC"}

package/dist/analyzers/dataAccessAnalyzer.js

@@ -0,0 +1,448 @@
+/**
+ * Data Access Analyzer (Functional)
+ * Analyzes database access patterns and data layer interactions
+ *
+ * Detects database usage, query patterns, performance risks,
+ * and security concerns in data access code
+ */
+import { processFiles, createViolation, parseTypeScriptFile, getImports, findNodesByKind, getLineAndColumn, getNodeText } from './analyzerUtils.js';
+import * as ts from 'typescript';
+/**
+ * Default configuration
+ */
+const DEFAULT_CONFIG = {
+    databases: {
+        'primary': {
+            name: 'Primary Database',
+            importPatterns: ['/database/', '/db/', 'drizzle', 'prisma', 'typeorm'],
+            queryPatterns: ['select', 'insert', 'update', 'delete', 'query'],
+            ormPatterns: ['from', 'where', 'join', 'orderBy', 'groupBy']
+        },
+        'secondary': {
+            name: 'Secondary Database',
+            importPatterns: ['/analytics/', '/reporting/'],
+            queryPatterns: ['query', 'execute', 'run'],
+            ormPatterns: []
+        }
+    },
+    organizationPatterns: [
+        'organizationId',
+        'organization_id',
+        'orgId',
+        'org_id',
+        'tenantId',
+        'tenant_id',
+        'companyId',
+        'company_id',
+        'filterByOrganization',
+        'whereOrganization',
+        'scopeToOrg'
+    ],
+    tablePatterns: {
+        orm: [
+            /\.from\(['"`]?(\w+)['"`]?\)/g,
+            /\.table\(['"`]?(\w+)['"`]?\)/g,
+            /\.into\(['"`]?(\w+)['"`]?\)/g,
+            /\.update\(['"`]?(\w+)['"`]?\)/g
+        ],
+        sql: [
+            /(?:FROM|JOIN|INTO|UPDATE)\s+['"`]?(\w+)['"`]?/gi,
+            /(?:INSERT\s+INTO)\s+['"`]?(\w+)['"`]?/gi,
+            /(?:DELETE\s+FROM)\s+['"`]?(\w+)['"`]?/gi
+        ],
+        queryBuilder: [
+            /table:\s*['"`](\w+)['"`]/g,
+            /from:\s*['"`](\w+)['"`]/g
+        ]
+    },
+    performanceThresholds: {
+        complexQueryCount: 3,
+        unfilteredQueryCount: 5,
+        joinedTableCount: 2
+    },
+    securityPatterns: {
+        sqlInjectionRisks: [
+            'concatenation',
+            '${',
+            'string interpolation',
+            '+ variable',
+            'raw(',
+            'unsafeRaw'
+        ],
+        parameterizedQueries: [
+            'prepared',
+            'parameterized',
+            'bind',
+            '?',
+            '$1',
+            ':param'
+        ]
+    },
+    sourcePatterns: {
+        api: ['/api/', '/routes/', '/endpoints/'],
+        page: ['/pages/', '/app/', '/views/'],
+        service: ['/services/', '/lib/', '/utils/']
+    }
+};
+/**
+ * Analyze a single file for data access patterns
+ */
+async function analyzeFile(filePath, config) {
+    const { sourceFile, errors } = await parseTypeScriptFile(filePath);
+    if (errors.length > 0) {
+        throw new Error(`Parse errors: ${errors.map(e => e.messageText).join(', ')}`);
+    }
+    const imports = getImports(sourceFile);
+    const patterns = [];
+    const violations = [];
+    // Extract database calls
+    const dbCalls = extractDatabaseCalls(sourceFile, imports, filePath, config);
+    // Group calls by database type
+    const callsByDb = new Map();
+    dbCalls.forEach(call => {
+        if (!callsByDb.has(call.type)) {
+            callsByDb.set(call.type, []);
+        }
+        callsByDb.get(call.type).push(call);
+    });
+    // Create patterns for each database type used
+    callsByDb.forEach((calls, dbType) => {
+        const allTables = new Set();
+        const queries = [];
+        let hasOrgFilter = false;
+        let hasSqlInjectionRisk = false;
+        calls.forEach(call => {
+            call.tables.forEach(table => allTables.add(table));
+            hasOrgFilter = hasOrgFilter || call.hasOrganizationFilter;
+            hasSqlInjectionRisk = hasSqlInjectionRisk || call.hasSqlInjectionRisk;
+            // Create query info with enhanced analysis
+            const queryInfo = extractQueryInfo(call, config);
+            queries.push(queryInfo);
+        });
+        const pattern = {
+            source: detectSourceType(filePath, config),
+            filePath,
+            database: dbType,
+            tables: Array.from(allTables),
+            queries,
+            hasOrganizationFilter: hasOrgFilter,
+            performanceRisk: assessPerformanceRisk(queries, config),
+            hasSqlInjectionRisk
+        };
+        patterns.push(pattern);
+        // Check for violations
+        violations.push(...checkDataAccessViolations(pattern));
+    });
+    return { patterns, violations };
+}
+/**
+ * Detect source type based on file path
+ */
+function detectSourceType(filePath, config) {
+    if (config.sourcePatterns.api.some(pattern => filePath.includes(pattern))) {
+        return 'api';
+    }
+    else if (config.sourcePatterns.page.some(pattern => filePath.includes(pattern))) {
+        return 'component';
+    }
+    else if (config.sourcePatterns.service.some(pattern => filePath.includes(pattern))) {
+        return 'service';
+    }
+    return 'service';
+}
+/**
+ * Extract database calls from the AST
+ */
+function extractDatabaseCalls(sourceFile, imports, filePath, config) {
+    const calls = [];
+    // Map imports to database types
+    const dbImports = mapDatabaseImports(imports, config);
+    // Find all call expressions
+    const callExpressions = findNodesByKind(sourceFile, ts.SyntaxKind.CallExpression);
+    callExpressions.forEach(callExpr => {
+        const callText = getNodeText(callExpr, sourceFile);
+        const { line, column } = getLineAndColumn(sourceFile, callExpr.getStart());
+        // Check each configured database
+        Object.entries(dbImports).forEach(([dbType, importInfo]) => {
+            if (importInfo.hasImports && isDatabaseCall(callText, importInfo)) {
+                const tables = extractTablesFromCall(callText, config);
+                const hasOrgFilter = checkOrganizationFilter(callText, config);
+                const securityCheck = checkQuerySecurity(callText, config);
+                calls.push({
+                    type: dbType,
+                    method: extractMethodName(callExpr),
+                    file: filePath,
+                    line,
+                    column,
+                    tables,
+                    hasOrganizationFilter: hasOrgFilter,
+                    hasParameterizedQuery: securityCheck.parameterized,
+                    hasSqlInjectionRisk: securityCheck.injectionRisk
+                });
+            }
+        });
+    });
+    return calls;
+}
+/**
+ * Map imports to database types
+ */
+function mapDatabaseImports(imports, config) {
+    const result = {};
+    Object.entries(config.databases).forEach(([key, dbConfig]) => {
+        const importNames = [];
+        let hasImports = false;
+        imports.forEach(imp => {
+            if (dbConfig.importPatterns.some((pattern) => imp.moduleSpecifier.includes(pattern))) {
+                hasImports = true;
+                importNames.push(...imp.importedNames);
+            }
+        });
+        result[key] = {
+            hasImports,
+            importNames,
+            patterns: [...dbConfig.queryPatterns, ...importNames]
+        };
+    });
+    return result;
+}
+/**
+ * Check if a call is a database call
+ */
+function isDatabaseCall(callText, importInfo) {
+    if (!importInfo.hasImports)
+        return false;
+    return importInfo.patterns.some(pattern => callText.includes(pattern));
+}
+/**
+ * Extract method name from call expression
+ */
+function extractMethodName(callExpr) {
+    const expression = callExpr.expression;
+    if (ts.isPropertyAccessExpression(expression)) {
+        return expression.name.text;
+    }
+    else if (ts.isIdentifier(expression)) {
+        return expression.text;
+    }
+    return 'unknown';
+}
+/**
+ * Extract table names from call
+ */
+function extractTablesFromCall(callText, config) {
+    const tables = new Set();
+    // Try all table extraction patterns
+    Object.values(config.tablePatterns).forEach(patterns => {
+        patterns.forEach(pattern => {
+            const matches = Array.from(callText.matchAll(pattern));
+            matches.forEach(match => {
+                if (match[1]) {
+                    tables.add(match[1].toLowerCase());
+                }
+            });
+        });
+    });
+    return Array.from(tables);
+}
+/**
+ * Check for organization filtering
+ */
+function checkOrganizationFilter(callText, config) {
+    return config.organizationPatterns.some(pattern => callText.toLowerCase().includes(pattern.toLowerCase()));
+}
+/**
+ * Check query security
+ */
+function checkQuerySecurity(callText, config) {
+    const hasParameterized = config.securityPatterns.parameterizedQueries.some(pattern => callText.includes(pattern));
+    const hasInjectionRisk = config.securityPatterns.sqlInjectionRisks.some(pattern => callText.includes(pattern));
+    return {
+        parameterized: hasParameterized,
+        injectionRisk: hasInjectionRisk && !hasParameterized
+    };
+}
+/**
+ * Extract query info from database call
+ */
+function extractQueryInfo(call, config) {
+    return {
+        type: inferQueryType(call.method),
+        tables: call.tables,
+        line: call.line,
+        hasJoins: detectJoins(call.method),
+        hasOrganizationFilter: call.hasOrganizationFilter,
+        complexity: analyzeQueryComplexity(call, config)
+    };
+}
+/**
+ * Infer query type from method name
+ */
+function inferQueryType(method) {
+    const methodLower = method.toLowerCase();
+    if (methodLower.includes('select') || methodLower.includes('find') || methodLower.includes('get')) {
+        return 'select';
+    }
+    else if (methodLower.includes('insert') || methodLower.includes('create')) {
+        return 'insert';
+    }
+    else if (methodLower.includes('update')) {
+        return 'update';
+    }
+    else if (methodLower.includes('delete') || methodLower.includes('remove')) {
+        return 'delete';
+    }
+    return 'other';
+}
+/**
+ * Detect if a query has joins
+ */
+function detectJoins(method) {
+    const joinPatterns = [
+        'join',
+        'leftJoin',
+        'rightJoin',
+        'innerJoin',
+        'outerJoin',
+        'fullJoin'
+    ];
+    return joinPatterns.some(pattern => method.toLowerCase().includes(pattern.toLowerCase()));
+}
+/**
+ * Analyze query complexity
+ */
+function analyzeQueryComplexity(call, config) {
+    let complexityScore = 0;
+    // Table count factor
+    if (call.tables.length > config.performanceThresholds.joinedTableCount) {
+        complexityScore += 2;
+    }
+    else if (call.tables.length > 1) {
+        complexityScore += 1;
+    }
+    // Method complexity
+    if (detectJoins(call.method)) {
+        complexityScore += 2;
+    }
+    // Security risk adds complexity
+    if (call.hasSqlInjectionRisk) {
+        complexityScore += 3;
+    }
+    // Missing org filter in multi-tenant context
+    if (!call.hasOrganizationFilter && call.tables.length > 0) {
+        complexityScore += 1;
+    }
+    // Determine complexity level
+    if (complexityScore >= 5)
+        return 'complex';
+    if (complexityScore >= 2)
+        return 'moderate';
+    return 'simple';
+}
+/**
+ * Assess performance risk based on queries
+ */
+function assessPerformanceRisk(queries, config) {
+    // Count complex queries
+    const complexQueries = queries.filter(q => q.hasJoins ||
+        q.tables.length > config.performanceThresholds.joinedTableCount ||
+        q.complexity === 'complex').length;
+    // Count queries without org filter
+    const unfiltered = queries.filter(q => !q.hasOrganizationFilter).length;
+    if (complexQueries > config.performanceThresholds.complexQueryCount ||
+        unfiltered > config.performanceThresholds.unfilteredQueryCount) {
+        return 'high';
+    }
+    else if (complexQueries > 1 || unfiltered > 2) {
+        return 'medium';
+    }
+    return 'low';
+}
+/**
+ * Check for data access violations
+ */
+function checkDataAccessViolations(pattern) {
+    const violations = [];
+    // Check for missing organization filter in multi-tenant scenarios
+    if (!pattern.hasOrganizationFilter && pattern.tables.length > 0) {
+        violations.push(createViolation({
+            analyzer: 'data-access',
+            severity: 'warning',
+            type: 'data-access',
+            file: pattern.filePath,
+            line: 1,
+            column: 1,
+            message: 'Database queries may be missing tenant/organization filtering',
+            recommendation: 'Add appropriate filtering to ensure data isolation in multi-tenant environments',
+            estimatedEffort: 'small'
+        }));
+    }
+    // Check for SQL injection risks
+    if (pattern.hasSqlInjectionRisk) {
+        violations.push(createViolation({
+            analyzer: 'data-access',
+            severity: 'critical',
+            type: 'data-access',
+            file: pattern.filePath,
+            line: 1,
+            column: 1,
+            message: 'Potential SQL injection vulnerability detected',
+            recommendation: 'Use parameterized queries or prepared statements instead of string concatenation',
+            estimatedEffort: 'medium'
+        }));
+    }
+    // Check for performance risks
+    if (pattern.performanceRisk === 'high') {
+        violations.push(createViolation({
+            analyzer: 'data-access',
+            severity: 'warning',
+            type: 'data-access',
+            file: pattern.filePath,
+            line: 1,
+            column: 1,
+            message: 'High performance risk detected in data access patterns',
+            recommendation: 'Optimize queries, add indexes, implement caching, or paginate results',
+            estimatedEffort: 'medium'
+        }));
+    }
+    // Check for direct database access in presentation layer
+    if (pattern.source === 'component') {
+        violations.push(createViolation({
+            analyzer: 'data-access',
+            severity: 'suggestion',
+            type: 'data-access',
+            file: pattern.filePath,
+            line: 1,
+            column: 1,
+            message: 'Direct database access detected in presentation layer',
+            recommendation: 'Consider moving data access to service layer or API endpoints for better separation of concerns',
+            estimatedEffort: 'medium'
+        }));
+    }
+    return violations;
+}
+/**
+ * Data Access Analyzer definition
+ */
+export const dataAccessAnalyzer = {
+    name: 'data-access',
+    defaultConfig: DEFAULT_CONFIG,
+    analyze: async (files, config, options, progressCallback) => {
+        const mergedConfig = { ...DEFAULT_CONFIG, ...config };
+        // Custom processor to handle patterns collection
+        const patterns = [];
+        const allViolations = [];
+        const result = await processFiles(files, async (filePath, sourceFile) => {
+            const fileResult = await analyzeFile(filePath, mergedConfig);
+            patterns.push(...fileResult.patterns);
+            allViolations.push(...fileResult.violations);
+            return fileResult.violations;
+        }, 'data-access', mergedConfig, progressCallback ?
+            (current, total, file) => progressCallback({ current, total, analyzer: 'data-access', file }) :
+            undefined);
+        // Override violations with our collected ones
+        result.violations = allViolations;
+        return result;
+    }
+};
+//# sourceMappingURL=dataAccessAnalyzer.js.map