code-auditor-mcp 4.0.3 → 4.1.0

package/dist/pipelineAdapters.js

@@ -26,6 +26,7 @@ import { isReactComponent, detectComponentType, getComponentName, } from './util
 import { findTableReferences, checkNamingConventions, checkQueryPatterns, checkSQLInjection, checkUnresolvedQueries, getNearestTableSuggestions, } from './analyzers/universal/schema/codeAnalysis.js';
 import { passesFileGate, extractTablesFromRegistry, } from './analyzers/universal/schema/discovery.js';
 import { applyMigrationOps, stripIdentifier } from './analyzers/universal/schema/migrations.js';
+import { buildOrgFilterTierSet, tableRequiresOrgFilter, } from './analyzers/orgFilterTiers.js';
 // ── Rule ID helpers ──────────────────────────────────────────────────────────
 function getRuleIdsFor(name) {
     return Object.entries(RULE_REGISTRY)
@@ -120,14 +121,91 @@ export function createDataAccessVisitor() {
         getRuleIds: () => getRuleIdsFor('data-access'),
         async visit(ast, adapter, context, sourceCode) {
             const a = await getAnalyzer();
-            const violations = await a.analyzeAST(ast, adapter, context.config, sourceCode);
-            return { violations, facts: {} };
+            // Spec 62 Amendment B — emit the extracted query facts (per-file) for the
+            // Stage-4 missing-org-filter reducer to join against the tenant tiers.
+            // The violations returned here exclude missing-org-filter (moved to the
+            // derived reducer); the calls carry resolved table + filter presence +
+            // DB provenance + the query-site location.
+            const { violations, calls } = await a.analyzeWithFacts(ast, adapter, context.config, sourceCode);
+            const facts = {};
+            if (calls.length > 0) {
+                facts[context.filePath] = { calls };
+            }
+            return { violations, facts };
         },
         defaultConfig: {},
         description: 'Analyzes database access patterns and data layer interactions',
         category: 'security',
     };
 }
+// ── Data-Access org-filter reducer (Spec 62 Amendment B) ─────────────────────
+/**
+ * Stage-4 derived reducer for `missing-org-filter`. It joins the data-access
+ * visitor's per-query facts (resolved tables + org-filter presence + query-site
+ * location) against the tenant tiers resolved from config + the schema
+ * reducer's corpus-wide DDL column catalog. Moving the rule here (out of the
+ * Stage-2 analyzer) is the fix for the Amendment B defect: the firing predicate
+ * needed the DDL tier only Stage 3 produces, but the Stage-2 analyzer could only
+ * read config tiers — so a DDL-declared multi-tenant codebase was un-suppressed
+ * without ever firing, and reported `clean` on a real leak.
+ *
+ * Firing and applicability both derive from {@link buildOrgFilterTierSet}, so
+ * they read the identical tier set (Tier 1 config / Tier 2 schema / Tier 3 DDL).
+ */
+export function createOrgFilterReducer() {
+    return {
+        name: 'data-access-org-filter',
+        stage: 'derivedReducer',
+        // Hard dependency on the data-access visitor's per-query facts. The schema
+        // table catalog (`allFacts['schema'].tableColumns`) is read opportunistically
+        // so an MCP-default run (which omits `schema`) degrades to Tier 1–2
+        // (config-only) instead of throwing — see buildOrgFilterTierSet.
+        consumes: ['data-access'],
+        getRuleIds: () => getRuleIdsFor('data-access-org-filter'),
+        async reduce(allFacts, context) {
+            const violations = [];
+            const schemaFacts = allFacts['schema'];
+            const ddlTableColumns = schemaFacts?.tableColumns;
+            // One tier source of truth — the same function the applicability predicate
+            // reads, so firing and applicability cannot drift to different tier sets.
+            const tierSet = buildOrgFilterTierSet(context.config, ddlTableColumns);
+            const daFacts = (allFacts['data-access'] ?? {});
+            for (const fileFacts of Object.values(daFacts)) {
+                for (const call of fileFacts.calls ?? []) {
+                    if (call.hasOrganizationFilter)
+                        continue;
+                    if (!call.tables || call.tables.length === 0)
+                        continue;
+                    if (!tableRequiresOrgFilter(call.tables, tierSet))
+                        continue;
+                    const symbol = `${call.enclosingFunction ?? 'top-level'}:${call.method}`;
+                    violations.push({
+                        file: call.file,
+                        line: call.line,
+                        column: call.column,
+                        severity: 'critical',
+                        message: `Query on ${call.tables.join(', ')} has no organization/tenant predicate`,
+                        suggestion: 'Add the tenant column (organization_id / org_id) to the WHERE predicate so this query is scoped to the current organization, not just by primary key.',
+                        // Structured next action (Spec 37 R1) — the rule is `resolvable`, so
+                        // the gate requires a `resolution`, not just the `suggestion` string.
+                        resolution: {
+                            action: 'add-tenant-predicate',
+                            summary: `Add the tenant column (organization_id / org_id) to the WHERE predicate on ${call.tables.join(', ')} so this query is scoped to the current organization, not just by primary key.`,
+                            symbols: call.tables,
+                        },
+                        rule: 'missing-org-filter',
+                        analyzer: 'data-access',
+                        functionName: symbol,
+                    });
+                }
+            }
+            return { violations, facts: {} };
+        },
+        defaultConfig: {},
+        description: 'Detects queries on tenant-scoped tables that omit an organization/tenant predicate',
+        category: 'security',
+    };
+}
 // ── Documentation visitor ────────────────────────────────────────────────────
 export function createDocumentationVisitor() {
     const getAnalyzer = lazySingleton(() => import('./analyzers/universal/UniversalDocumentationAnalyzer.js').then((m) => new m.UniversalDocumentationAnalyzer()));
@@ -162,6 +240,23 @@ export function createSecretsVisitor() {
         category: 'security',
     };
 }
+// ── Security visitor (Spec 61 R6) ────────────────────────────────────────────
+export function createSecurityVisitor() {
+    const getAnalyzer = lazySingleton(() => import('./analyzers/universal/UniversalSecurityAnalyzer.js').then((m) => new m.UniversalSecurityAnalyzer()));
+    return {
+        name: 'security',
+        stage: 'visitor',
+        getRuleIds: () => getRuleIdsFor('security'),
+        async visit(ast, adapter, context, sourceCode) {
+            const a = await getAnalyzer();
+            const violations = await a.analyzeAST(ast, adapter, context.config, sourceCode);
+            return { violations, facts: {} };
+        },
+        defaultConfig: {},
+        description: 'Detects command injection, dynamic require of project paths, and unescaped HTML interpolation',
+        category: 'security',
+    };
+}
 // ── Function-Index visitor (infrastructure) ──────────────────────────────────
 // Always-on Stage 2 visitor that populates the `functions` table with
 // per-file definitions so the conventions and cross-domain reducers have data
@@ -609,6 +704,11 @@ export function createStylesCssVisitor() {
  * styles and (b) skip re-writing files whose stored rows are already current.
  */
 export function createStylesSourceVisitor() {
+    // Spec 61 R3.4 — a project tailwind config that exists but cannot be read
+    // statically is a `cannot-fire` coverage diagnostic. Emit it exactly once per
+    // visitor instance (the config is project-global, not per-file) so a config
+    // gap reads once, not once per source file.
+    let emittedTailwindDiagnostic = false;
     return {
         name: 'styles-source',
         stage: 'visitor',
@@ -624,15 +724,22 @@ export function createStylesSourceVisitor() {
             const filePath = context.filePath;
             // Memoized per projectRoot (the style-index sync already called it this
             // run), so this is a cache hit — never a re-walk of the project tree.
-            const tailwindTokens = loadTailwindConfig(context.projectRoot).tokens;
+            const tailwindConfig = loadTailwindConfig(context.projectRoot);
+            const tailwindTokens = tailwindConfig.tokens;
             const declarations = extractDeclarations(filePath, tsAdapter, sourceCode, tsAst, tailwindTokens);
             const classUsage = extractClassUsage(filePath, sourceCode);
             const contentHash = createHash('sha256').update(sourceCode).digest('hex');
+            const diagnostic = tailwindConfig.diagnostic && !emittedTailwindDiagnostic
+                ? tailwindConfig.diagnostic
+                : undefined;
+            if (diagnostic)
+                emittedTailwindDiagnostic = true;
             return {
                 violations: [],
                 facts: {
                     [filePath]: { declarations, classUsage, contentHash },
                 },
+                ...(diagnostic ? { diagnostics: [diagnostic] } : {}),
             };
         },
         defaultConfig: {},
@@ -2124,13 +2231,14 @@ export function createSchemaSqlVisitor() {
         getRuleIds: () => [],
         async visit(_ast, _adapter, context, sourceCode) {
             const { extractMigrationOpsFromFile } = await getMigrationExtractor();
-            const { ops, columns, skipped, bytes } = await extractMigrationOpsFromFile(context.filePath, sourceCode);
+            const { ops, columns, tableColumns, skipped, bytes } = await extractMigrationOpsFromFile(context.filePath, sourceCode);
             return {
                 violations: [],
                 facts: {
                     [context.filePath]: {
                         ddlOps: ops,
                         ...(columns.length > 0 && { ddlColumns: columns }),
+                        ...(Object.keys(tableColumns).length > 0 && { ddlTableColumns: tableColumns }),
                         ...(skipped && { skipped: true, bytes }),
                     },
                 },
@@ -2151,6 +2259,7 @@ export function createSchemaCodeVisitor() {
         defaults: m.DEFAULT_SCHEMA_CONFIG,
         parseMigrationOps: m.parseMigrationOps,
         extractDdlColumnNames: m.extractDdlColumnNames,
+        extractDdlTableColumns: m.extractDdlTableColumns,
     })));
     return {
         name: 'schema-code',
@@ -2158,7 +2267,7 @@ export function createSchemaCodeVisitor() {
         extensions: ['.ts', '.tsx', '.js', '.jsx', '.mts', '.cts', '.mjs', '.cjs'],
         getRuleIds: () => getRuleIdsFor('schema'),
         async visit(ast, adapter, context, sourceCode) {
-            const { analyzer: a, defaults, parseMigrationOps, extractDdlColumnNames } = await getAnalyzer();
+            const { analyzer: a, defaults, parseMigrationOps, extractDdlColumnNames, extractDdlTableColumns } = await getAnalyzer();
             const pm = await _getProvenanceModule();
             const violations = [];
             const diagnostics = [];
@@ -2208,6 +2317,7 @@ export function createSchemaCodeVisitor() {
             }
             const doDDLSql = doDDL.length > 0 ? doDDL.join(';\n') : null;
             const doDDLColumns = doDDLSql ? extractDdlColumnNames(doDDLSql) : [];
+            const doDDLTableColumns = doDDLSql ? extractDdlTableColumns(doDDLSql) : {};
             // Build provenance context for this file — defaults from DEFAULT_SCHEMA_CONFIG
             const detectionMode = schemaConfig.detection?.mode ?? 'hybrid';
             const provenanceContext = pm.buildProvenanceContext(ast, adapter, sourceCode, {
@@ -2224,6 +2334,8 @@ export function createSchemaCodeVisitor() {
                     facts[context.filePath].ddlOps = parseMigrationOps(doDDLSql);
                     if (doDDLColumns.length > 0)
                         facts[context.filePath].ddlColumns = doDDLColumns;
+                    if (Object.keys(doDDLTableColumns).length > 0)
+                        facts[context.filePath].ddlTableColumns = doDDLTableColumns;
                 }
                 return { violations: [], facts };
             }
@@ -2302,6 +2414,8 @@ export function createSchemaCodeVisitor() {
                 fileFacts.ddlOps = parseMigrationOps(doDDLSql);
                 if (doDDLColumns.length > 0)
                     fileFacts.ddlColumns = doDDLColumns;
+                if (Object.keys(doDDLTableColumns).length > 0)
+                    fileFacts.ddlTableColumns = doDDLTableColumns;
             }
             return {
                 violations,
@@ -2523,12 +2637,32 @@ export function createSchemaReducer() {
             //      the reducer folds them into a single case-insensitive, deduplicated
             //      set so downstream applicability predicates can ask "does ANY table
             //      carry a tenant-scoping column?" without per-table column lists.
+            //
+            //      Spec 62 Amendment B — additionally fold the per-table
+            //      `ddlTableColumns` into a corpus-wide `tableColumns` (Record<table,
+            //      string[]>) so the Stage-4 missing-org-filter reducer can answer the
+            //      per-query question "does THIS table carry a tenant column?" that the
+            //      flat set cannot.
             const ddlColumns = new Set();
+            const tableColumnsMap = new Map();
             for (const [filePath, fact] of perFile()) {
                 const cols = fact.ddlColumns ?? [];
                 for (const c of cols)
                     ddlColumns.add(String(c).toLowerCase());
+                const perTable = fact.ddlTableColumns ?? {};
+                for (const [table, tableCols] of Object.entries(perTable)) {
+                    let set = tableColumnsMap.get(table);
+                    if (!set) {
+                        set = new Set();
+                        tableColumnsMap.set(table, set);
+                    }
+                    for (const c of tableCols)
+                        set.add(String(c).toLowerCase());
+                }
             }
+            const tableColumns = {};
+            for (const [table, set] of tableColumnsMap)
+                tableColumns[table] = [...set];
             // ── 2. Unknown-table detection ────────────────────────────────────────
             //
             // Fail-open guardrail: we can only accuse when the table catalog is
@@ -2678,7 +2812,7 @@ export function createSchemaReducer() {
             }
             return {
                 violations,
-                facts: { tableCatalog: catalogEntries, ddlColumns: [...ddlColumns].sort() },
+                facts: { tableCatalog: catalogEntries, ddlColumns: [...ddlColumns].sort(), tableColumns },
                 factsConsumed: [...perFile()].length,
             };
         },