eslint-plugin-ai-guard 1.0.0

package/dist/index.js

@@ -0,0 +1,928 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  default: () => index_default,
+  recommended: () => recommended_default,
+  rules: () => allRules,
+  security: () => security_default,
+  strict: () => strict_default
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/rules/error-handling/no-empty-catch.ts
+var import_utils = require("@typescript-eslint/utils");
+var createRule = import_utils.ESLintUtils.RuleCreator(
+  (name) => `https://github.com/YashJadhav21/eslint-plugin-ai-guard/blob/main/docs/rules/${name}.md`
+);
+var noEmptyCatch = createRule({
+  name: "no-empty-catch",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow empty catch blocks. AI tools frequently generate try/catch with empty catch bodies that silently swallow errors, hiding failures in production."
+    },
+    fixable: void 0,
+    schema: [],
+    messages: {
+      emptyCatch: "Catch block is empty. AI tools frequently generate empty catch blocks that silently swallow errors. Handle the error (log, rethrow, or recover), or add a comment explaining why it is intentionally empty."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    return {
+      CatchClause(node) {
+        if (node.body.body.length === 0) {
+          const sourceCode = context.sourceCode;
+          const comments = sourceCode.getCommentsInside(node.body);
+          if (comments.length > 0) {
+            return;
+          }
+          context.report({
+            node,
+            messageId: "emptyCatch"
+          });
+        }
+      }
+    };
+  }
+});
+
+// src/rules/error-handling/no-broad-exception.ts
+var import_utils2 = require("@typescript-eslint/utils");
+var createRule2 = import_utils2.ESLintUtils.RuleCreator(
+  (name) => `https://github.com/YashJadhav21/eslint-plugin-ai-guard/blob/main/docs/rules/${name}.md`
+);
+var noBroadException = createRule2({
+  name: "no-broad-exception",
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Disallow overly broad catch clause types such as `catch (e: any)` or `catch (e: unknown)` without narrowing. AI tools frequently use `any` type annotations on catch parameters, hiding the actual error type and preventing proper error handling."
+    },
+    fixable: void 0,
+    schema: [],
+    messages: {
+      broadException: "Catch parameter has an overly broad type annotation `{{type}}`. AI tools frequently generate `catch (e: any)` which hides the real error type. Use a specific error type or narrow with `instanceof` checks inside the catch block."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    return {
+      CatchClause(node) {
+        const param = node.param;
+        if (!param) return;
+        if (param.type === import_utils2.AST_NODE_TYPES.Identifier && param.typeAnnotation && param.typeAnnotation.typeAnnotation) {
+          const typeAnnotation = param.typeAnnotation.typeAnnotation;
+          if (typeAnnotation.type === import_utils2.AST_NODE_TYPES.TSAnyKeyword) {
+            context.report({
+              node: param,
+              messageId: "broadException",
+              data: { type: "any" }
+            });
+            return;
+          }
+          if (typeAnnotation.type === import_utils2.AST_NODE_TYPES.TSUnknownKeyword) {
+            const hasNarrowing = checkForNarrowing(node, param.name);
+            if (!hasNarrowing) {
+              context.report({
+                node: param,
+                messageId: "broadException",
+                data: { type: "unknown" }
+              });
+            }
+          }
+        }
+      }
+    };
+  }
+});
+function checkForNarrowing(catchClause, paramName) {
+  const bodyStatements = catchClause.body.body;
+  for (const stmt of bodyStatements) {
+    if (containsInstanceofCheck(stmt, paramName)) {
+      return true;
+    }
+  }
+  return false;
+}
+function containsInstanceofCheck(node, paramName) {
+  if (!node || typeof node !== "object") return false;
+  if (node.type === import_utils2.AST_NODE_TYPES.BinaryExpression && node.operator === "instanceof" && node.left?.type === import_utils2.AST_NODE_TYPES.Identifier && node.left.name === paramName) {
+    return true;
+  }
+  for (const key of Object.keys(node)) {
+    if (key === "parent") continue;
+    const child = node[key];
+    if (Array.isArray(child)) {
+      for (const item of child) {
+        if (containsInstanceofCheck(item, paramName)) return true;
+      }
+    } else if (child && typeof child === "object" && child.type) {
+      if (containsInstanceofCheck(child, paramName)) return true;
+    }
+  }
+  return false;
+}
+
+// src/rules/async/no-async-array-callback.ts
+var import_utils3 = require("@typescript-eslint/utils");
+var createRule3 = import_utils3.ESLintUtils.RuleCreator(
+  (name) => `https://github.com/YashJadhav21/eslint-plugin-ai-guard/blob/main/docs/rules/${name}.md`
+);
+var ARRAY_CALLBACK_METHODS = ["map", "filter", "forEach", "reduce", "flatMap", "find", "findIndex", "some", "every"];
+var PROMISE_COMBINATORS = ["all", "allSettled", "race", "any"];
+function isWrappedInPromiseCombinator(node, context) {
+  const ancestors = context.sourceCode.getAncestors(node);
+  for (let i = ancestors.length - 1; i >= 0; i--) {
+    const ancestor = ancestors[i];
+    if (ancestor.type === import_utils3.AST_NODE_TYPES.CallExpression && ancestor.callee.type === import_utils3.AST_NODE_TYPES.MemberExpression && ancestor.callee.object.type === import_utils3.AST_NODE_TYPES.Identifier && ancestor.callee.object.name === "Promise" && ancestor.callee.property.type === import_utils3.AST_NODE_TYPES.Identifier && PROMISE_COMBINATORS.includes(
+      ancestor.callee.property.name
+    )) {
+      return true;
+    }
+    if (ancestor.type === import_utils3.AST_NODE_TYPES.CallExpression) {
+      break;
+    }
+  }
+  return false;
+}
+function isAsyncCallback(node) {
+  return (node.type === import_utils3.AST_NODE_TYPES.FunctionExpression || node.type === import_utils3.AST_NODE_TYPES.ArrowFunctionExpression) && node.async;
+}
+var noAsyncArrayCallback = createRule3({
+  name: "no-async-array-callback",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow async callbacks in array iteration methods (map, filter, forEach, reduce). AI tools generate `array.map(async ...)` which returns `Promise[]` instead of resolved values \u2014 a silent bug."
+    },
+    fixable: void 0,
+    schema: [],
+    messages: {
+      asyncArrayCallback: "Async callback passed to Array.{{method}}(). This returns an array of Promises, not resolved values. AI tools frequently generate this pattern. Wrap with `await Promise.all(array.{{method}}(...))` or use a for...of loop."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    return {
+      CallExpression(node) {
+        if (node.callee.type !== import_utils3.AST_NODE_TYPES.MemberExpression || node.callee.property.type !== import_utils3.AST_NODE_TYPES.Identifier) {
+          return;
+        }
+        const methodName = node.callee.property.name;
+        if (!ARRAY_CALLBACK_METHODS.includes(
+          methodName
+        )) {
+          return;
+        }
+        const callback = node.arguments[0];
+        if (!callback) {
+          return;
+        }
+        if (isAsyncCallback(callback)) {
+          if (isWrappedInPromiseCombinator(node, context)) {
+            return;
+          }
+          context.report({
+            node: callback,
+            messageId: "asyncArrayCallback",
+            data: {
+              method: methodName
+            }
+          });
+        }
+      }
+    };
+  }
+});
+
+// src/rules/async/no-floating-promise.ts
+var import_utils4 = require("@typescript-eslint/utils");
+var createRule4 = import_utils4.ESLintUtils.RuleCreator(
+  (name) => `https://github.com/YashJadhav21/eslint-plugin-ai-guard/blob/main/docs/rules/${name}.md`
+);
+function looksLikeAsyncCall(node) {
+  if (node.callee.type === import_utils4.AST_NODE_TYPES.Identifier) {
+    return hasAsyncishName(node.callee.name);
+  }
+  if (node.callee.type === import_utils4.AST_NODE_TYPES.MemberExpression && node.callee.property.type === import_utils4.AST_NODE_TYPES.Identifier) {
+    return hasAsyncishName(node.callee.property.name);
+  }
+  return false;
+}
+function hasAsyncishName(name) {
+  const lower = name.toLowerCase();
+  return lower.startsWith("fetch") || lower.startsWith("load") || lower.startsWith("save") || lower.startsWith("delete") || lower.startsWith("create") || lower.startsWith("update") || lower.startsWith("get") || lower.startsWith("post") || lower.startsWith("put") || lower.startsWith("patch") || lower.startsWith("send") || lower.startsWith("upload") || lower.startsWith("download") || lower.startsWith("connect") || lower.startsWith("disconnect") || lower.startsWith("subscribe") || lower.startsWith("publish") || lower.startsWith("request") || lower.startsWith("query") || lower === "axios" || lower === "fetch";
+}
+function isCalleeAsync(node, asyncFunctionNames) {
+  if (node.callee.type === import_utils4.AST_NODE_TYPES.Identifier) {
+    if (asyncFunctionNames.has(node.callee.name)) {
+      return true;
+    }
+  }
+  return looksLikeAsyncCall(node);
+}
+function isExpressionHandled(node) {
+  const expr = node.expression;
+  if (expr.type === import_utils4.AST_NODE_TYPES.CallExpression) {
+    if (expr.callee.type === import_utils4.AST_NODE_TYPES.MemberExpression) {
+      const prop = expr.callee.property;
+      if (prop.type === import_utils4.AST_NODE_TYPES.Identifier) {
+        if (prop.name === "then" || prop.name === "catch" || prop.name === "finally") {
+          return true;
+        }
+      }
+    }
+  }
+  if (expr.type === import_utils4.AST_NODE_TYPES.UnaryExpression && expr.operator === "void") {
+    return true;
+  }
+  return false;
+}
+var noFloatingPromise = createRule4({
+  name: "no-floating-promise",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow calling an async function or Promise-returning function without awaiting or handling the result. AI tools frequently generate floating promises where errors disappear silently."
+    },
+    fixable: void 0,
+    schema: [],
+    messages: {
+      floatingPromise: "This async call is not awaited, returned, or error-handled (.catch). AI tools frequently generate floating promises, causing errors to be silently lost. Add `await`, `.catch()`, or assign the result."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    const asyncFunctionNames = /* @__PURE__ */ new Set();
+    return {
+      // Track async function declarations
+      FunctionDeclaration(node) {
+        if (node.async && node.id) {
+          asyncFunctionNames.add(node.id.name);
+        }
+      },
+      // Track async arrow functions assigned to variables
+      VariableDeclarator(node) {
+        if (node.init && (node.init.type === import_utils4.AST_NODE_TYPES.ArrowFunctionExpression || node.init.type === import_utils4.AST_NODE_TYPES.FunctionExpression) && node.init.async && node.id.type === import_utils4.AST_NODE_TYPES.Identifier) {
+          asyncFunctionNames.add(node.id.name);
+        }
+      },
+      // Check ExpressionStatements — standalone call expressions
+      ExpressionStatement(node) {
+        if (node.expression.type !== import_utils4.AST_NODE_TYPES.CallExpression) {
+          return;
+        }
+        if (isExpressionHandled(node)) {
+          return;
+        }
+        const callExpr = node.expression;
+        if (isCalleeAsync(callExpr, asyncFunctionNames)) {
+          context.report({
+            node,
+            messageId: "floatingPromise"
+          });
+        }
+      }
+    };
+  }
+});
+
+// src/rules/async/no-await-in-loop.ts
+var import_utils5 = require("@typescript-eslint/utils");
+var createRule5 = import_utils5.ESLintUtils.RuleCreator(
+  (name) => `https://github.com/YashJadhav21/eslint-plugin-ai-guard/blob/main/docs/rules/${name}.md`
+);
+var LOOP_TYPES = /* @__PURE__ */ new Set([
+  import_utils5.AST_NODE_TYPES.ForStatement,
+  import_utils5.AST_NODE_TYPES.ForInStatement,
+  import_utils5.AST_NODE_TYPES.ForOfStatement,
+  import_utils5.AST_NODE_TYPES.WhileStatement,
+  import_utils5.AST_NODE_TYPES.DoWhileStatement
+]);
+var noAwaitInLoop = createRule5({
+  name: "no-await-in-loop",
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Disallow `await` inside loops. AI tools frequently generate sequential awaits inside for/while loops where `Promise.all()` would be more efficient and correct. Each iteration waits for the previous one to complete, causing O(n) latency instead of O(1)."
+    },
+    fixable: void 0,
+    schema: [],
+    messages: {
+      awaitInLoop: "Unexpected `await` inside a {{loopType}}. AI tools frequently generate sequential awaits in loops, causing O(n) latency. Consider collecting promises and using `Promise.all()` for parallel execution."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    const functionBoundary = [];
+    function enterFunction(node) {
+      functionBoundary.push(node);
+    }
+    function exitFunction() {
+      functionBoundary.pop();
+    }
+    return {
+      FunctionDeclaration: enterFunction,
+      FunctionExpression: enterFunction,
+      ArrowFunctionExpression: enterFunction,
+      "FunctionDeclaration:exit": exitFunction,
+      "FunctionExpression:exit": exitFunction,
+      "ArrowFunctionExpression:exit": exitFunction,
+      AwaitExpression(node) {
+        const ancestors = context.sourceCode.getAncestors(node);
+        const currentFunction = functionBoundary[functionBoundary.length - 1];
+        for (let i = ancestors.length - 1; i >= 0; i--) {
+          const ancestor = ancestors[i];
+          if (ancestor === currentFunction) {
+            break;
+          }
+          if (LOOP_TYPES.has(ancestor.type)) {
+            const loopName = getLoopName(ancestor.type);
+            context.report({
+              node,
+              messageId: "awaitInLoop",
+              data: { loopType: loopName }
+            });
+            return;
+          }
+        }
+      }
+    };
+  }
+});
+function getLoopName(type) {
+  switch (type) {
+    case import_utils5.AST_NODE_TYPES.ForStatement:
+      return "for loop";
+    case import_utils5.AST_NODE_TYPES.ForInStatement:
+      return "for...in loop";
+    case import_utils5.AST_NODE_TYPES.ForOfStatement:
+      return "for...of loop";
+    case import_utils5.AST_NODE_TYPES.WhileStatement:
+      return "while loop";
+    case import_utils5.AST_NODE_TYPES.DoWhileStatement:
+      return "do...while loop";
+    default:
+      return "loop";
+  }
+}
+
+// src/rules/security/no-hardcoded-secret.ts
+var import_utils6 = require("@typescript-eslint/utils");
+var createRule6 = import_utils6.ESLintUtils.RuleCreator(
+  (name) => `https://github.com/YashJadhav21/eslint-plugin-ai-guard/blob/main/docs/rules/${name}.md`
+);
+var SECRET_NAME_PATTERN = /(?:secret|password|passwd|api[_-]?key|auth[_-]?token|access[_-]?token|private[_-]?key|client[_-]?secret|jwt[_-]?secret|encryption[_-]?key|signing[_-]?key)/i;
+var FALSE_POSITIVE_VALUES = /* @__PURE__ */ new Set([
+  "password",
+  "secret",
+  "token",
+  "key",
+  "api_key",
+  "apikey",
+  "",
+  "undefined",
+  "null",
+  "test",
+  "example",
+  "placeholder",
+  "changeme",
+  "your-api-key",
+  "your-secret",
+  "YOUR_API_KEY",
+  "YOUR_SECRET",
+  "xxx",
+  "TODO"
+]);
+var noHardcodedSecret = createRule6({
+  name: "no-hardcoded-secret",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow hardcoded secrets, API keys, passwords, and tokens in source code. AI tools frequently generate placeholder credentials that get committed to version control, creating security vulnerabilities."
+    },
+    fixable: void 0,
+    schema: [],
+    messages: {
+      hardcodedSecret: "Possible hardcoded secret in variable `{{name}}`. AI tools frequently generate placeholder credentials that get committed to version control. Use environment variables (e.g., `process.env.{{envName}}`) instead."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    return {
+      VariableDeclarator(node) {
+        if (!node.init) return;
+        if (!node.id || node.id.type !== import_utils6.AST_NODE_TYPES.Identifier) return;
+        const varName = node.id.name;
+        if (!SECRET_NAME_PATTERN.test(varName)) return;
+        const value = getStringValue(node.init);
+        if (value === null) return;
+        if (FALSE_POSITIVE_VALUES.has(value)) return;
+        if (value.length < 8) return;
+        if (isProcessEnvAccess(node.init)) return;
+        context.report({
+          node: node.init,
+          messageId: "hardcodedSecret",
+          data: {
+            name: varName,
+            envName: toEnvVarName(varName)
+          }
+        });
+      },
+      // Also check: obj.secret = 'literal_value'
+      AssignmentExpression(node) {
+        if (node.left.type !== import_utils6.AST_NODE_TYPES.MemberExpression) return;
+        if (node.left.property.type !== import_utils6.AST_NODE_TYPES.Identifier) return;
+        const propName = node.left.property.name;
+        if (!SECRET_NAME_PATTERN.test(propName)) return;
+        const value = getStringValue(node.right);
+        if (value === null) return;
+        if (FALSE_POSITIVE_VALUES.has(value)) return;
+        if (value.length < 8) return;
+        if (isProcessEnvAccess(node.right)) return;
+        context.report({
+          node: node.right,
+          messageId: "hardcodedSecret",
+          data: {
+            name: propName,
+            envName: toEnvVarName(propName)
+          }
+        });
+      },
+      // Check property assignments in object literals: { secret: 'value' }
+      Property(node) {
+        if (node.key.type !== import_utils6.AST_NODE_TYPES.Identifier) return;
+        const propName = node.key.name;
+        if (!SECRET_NAME_PATTERN.test(propName)) return;
+        const value = getStringValue(node.value);
+        if (value === null) return;
+        if (FALSE_POSITIVE_VALUES.has(value)) return;
+        if (value.length < 8) return;
+        if (isProcessEnvAccess(node.value)) return;
+        context.report({
+          node: node.value,
+          messageId: "hardcodedSecret",
+          data: {
+            name: propName,
+            envName: toEnvVarName(propName)
+          }
+        });
+      }
+    };
+  }
+});
+function getStringValue(node) {
+  if (node.type === import_utils6.AST_NODE_TYPES.Literal && typeof node.value === "string") {
+    return node.value;
+  }
+  if (node.type === import_utils6.AST_NODE_TYPES.TemplateLiteral && node.expressions.length === 0 && node.quasis.length === 1) {
+    return node.quasis[0].value.cooked ?? null;
+  }
+  return null;
+}
+function isProcessEnvAccess(node) {
+  return node.type === import_utils6.AST_NODE_TYPES.MemberExpression && node.object.type === import_utils6.AST_NODE_TYPES.MemberExpression && node.object.object.type === import_utils6.AST_NODE_TYPES.Identifier && node.object.object.name === "process" && node.object.property.type === import_utils6.AST_NODE_TYPES.Identifier && node.object.property.name === "env";
+}
+function toEnvVarName(name) {
+  return name.replace(/([a-z])([A-Z])/g, "$1_$2").replace(/[-\s]/g, "_").toUpperCase();
+}
+
+// src/rules/security/no-eval-dynamic.ts
+var import_utils7 = require("@typescript-eslint/utils");
+var createRule7 = import_utils7.ESLintUtils.RuleCreator(
+  (name) => `https://github.com/YashJadhav21/eslint-plugin-ai-guard/blob/main/docs/rules/${name}.md`
+);
+var noEvalDynamic = createRule7({
+  name: "no-eval-dynamic",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow `eval()` and `new Function()` with non-literal arguments. AI tools frequently generate dynamic code evaluation patterns that create serious security vulnerabilities including code injection and XSS."
+    },
+    fixable: void 0,
+    schema: [],
+    messages: {
+      evalDynamic: "Dangerous use of `{{callee}}` with a dynamic argument. AI tools frequently generate `eval()` or `new Function()` patterns that enable code injection attacks. Use safer alternatives like JSON.parse(), a lookup table, or a sandboxed evaluator.",
+      newFunctionDynamic: "Dangerous use of `new Function()` with a dynamic argument. AI tools frequently generate this pattern which enables arbitrary code execution. Use safer alternatives like a lookup table or pre-defined functions."
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    return {
+      CallExpression(node) {
+        if (node.callee.type === import_utils7.AST_NODE_TYPES.Identifier && node.callee.name === "eval") {
+          if (node.arguments.length === 0) return;
+          const firstArg = node.arguments[0];
+          if (isLiteral(firstArg)) return;
+          context.report({
+            node,
+            messageId: "evalDynamic",
+            data: { callee: "eval()" }
+          });
+          return;
+        }
+        if (node.callee.type === import_utils7.AST_NODE_TYPES.MemberExpression && node.callee.property.type === import_utils7.AST_NODE_TYPES.Identifier && node.callee.property.name === "eval" && node.callee.object.type === import_utils7.AST_NODE_TYPES.Identifier && (node.callee.object.name === "window" || node.callee.object.name === "globalThis")) {
+          if (node.arguments.length === 0) return;
+          const firstArg = node.arguments[0];
+          if (isLiteral(firstArg)) return;
+          context.report({
+            node,
+            messageId: "evalDynamic",
+            data: { callee: `${node.callee.object.name}.eval()` }
+          });
+        }
+      },
+      NewExpression(node) {
+        if (node.callee.type === import_utils7.AST_NODE_TYPES.Identifier && node.callee.name === "Function") {
+          if (node.arguments.length === 0) return;
+          const allLiteral = node.arguments.every(isLiteral);
+          if (allLiteral) return;
+          context.report({
+            node,
+            messageId: "newFunctionDynamic"
+          });
+        }
+      }
+    };
+  }
+});
+function isLiteral(node) {
+  if (node.type === import_utils7.AST_NODE_TYPES.Literal) return true;
+  if (node.type === import_utils7.AST_NODE_TYPES.TemplateLiteral && node.expressions.length === 0) {
+    return true;
+  }
+  return false;
+}
+
+// src/rules/security/no-sql-string-concat.ts
+var import_utils8 = require("@typescript-eslint/utils");
+var createRule8 = import_utils8.ESLintUtils.RuleCreator(
+  (name) => `https://github.com/YashJadhav21/eslint-plugin-ai-guard/blob/main/docs/rules/${name}.md`
+);
+var SQL_KEYWORDS = /\b(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|EXEC|EXECUTE|UNION|WHERE|FROM|JOIN|INTO|VALUES|SET|TABLE|DATABASE|GRANT|REVOKE|TRUNCATE)\b/i;
+var noSqlStringConcat = createRule8({
+  name: "no-sql-string-concat",
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow string concatenation or interpolation with variables in SQL query contexts. AI tools frequently generate SQL queries using template literals or string concatenation with user input, creating SQL injection vulnerabilities."
+    },
+    fixable: void 0,
+    schema: [],
+    messages: {
+      sqlStringConcat: 'Potential SQL injection: string concatenation or interpolation detected in a SQL query. AI tools frequently generate this pattern. Use parameterized queries (e.g., `db.query("SELECT * FROM users WHERE id = $1", [id])`) instead.'
+    }
+  },
+  defaultOptions: [],
+  create(context) {
+    return {
+      // Template literals: `SELECT * FROM users WHERE id = ${userId}`
+      TemplateLiteral(node) {
+        if (node.expressions.length === 0) return;
+        const staticText = node.quasis.map((q) => q.value.raw).join("");
+        if (SQL_KEYWORDS.test(staticText)) {
+          context.report({
+            node,
+            messageId: "sqlStringConcat"
+          });
+        }
+      },
+      // Binary expressions: "SELECT * FROM users WHERE id = " + userId
+      BinaryExpression(node) {
+        if (node.operator !== "+") return;
+        const leftStr = getStringLiteralValue(node.left);
+        const rightStr = getStringLiteralValue(node.right);
+        if (leftStr && SQL_KEYWORDS.test(leftStr) || rightStr && SQL_KEYWORDS.test(rightStr)) {
+          const leftIsDynamic = !isStaticString(node.left);
+          const rightIsDynamic = !isStaticString(node.right);
+          if (leftIsDynamic || rightIsDynamic) {
+            context.report({
+              node,
+              messageId: "sqlStringConcat"
+            });
+          }
+        }
+      }
+    };
+  }
+});
+function getStringLiteralValue(node) {
+  if (node.type === import_utils8.AST_NODE_TYPES.Literal && typeof node.value === "string") {
+    return node.value;
+  }
+  return null;
+}
+function isStaticString(node) {
+  if (node.type === import_utils8.AST_NODE_TYPES.Literal && typeof node.value === "string") {
+    return true;
+  }
+  if (node.type === import_utils8.AST_NODE_TYPES.TemplateLiteral && node.expressions.length === 0) {
+    return true;
+  }
+  return false;
+}
+
+// src/rules/security/require-auth-middleware.ts
+var import_utils9 = require("@typescript-eslint/utils");
+var createRule9 = import_utils9.ESLintUtils.RuleCreator(
+  (name) => `https://github.com/YashJadhav21/eslint-plugin-ai-guard/blob/main/docs/rules/${name}.md`
+);
+var HTTP_METHODS = /* @__PURE__ */ new Set([
+  "get",
+  "post",
+  "put",
+  "patch",
+  "delete",
+  "all",
+  "options",
+  "head"
+]);
+var DEFAULT_AUTH_MIDDLEWARE_NAMES = /* @__PURE__ */ new Set([
+  "authenticate",
+  "requireAuth",
+  "isAuthenticated",
+  "verifyToken",
+  "protect",
+  "authorized",
+  "authorize",
+  "isAdmin",
+  "ensureAuthenticated",
+  "ensureLoggedIn",
+  "auth",
+  "authMiddleware",
+  "requireLogin",
+  "checkAuth",
+  "validateToken",
+  "passport.authenticate",
+  "jwt",
+  "requireSession"
+]);
+var PUBLIC_ROUTE_PATTERNS = [
+  /^\/?$/,
+  // '/' root
+  /^\/health/,
+  // health checks
+  /^\/ping/,
+  // ping
+  /^\/status/,
+  // status
+  /^\/api\/v\d+\/auth/,
+  // auth routes
+  /^\/auth/,
+  // auth routes
+  /^\/login/,
+  // login
+  /^\/register/,
+  // register
+  /^\/signup/,
+  // signup
+  /^\/forgot/,
+  // forgot password
+  /^\/reset/,
+  // reset password
+  /^\/webhook/,
+  // webhooks
+  /^\/public/,
+  // explicitly public
+  /^\/assets/,
+  // static assets
+  /^\/static/,
+  // static files
+  /^\/favicon/,
+  // favicon
+  /^\/robots/,
+  // robots.txt
+  /^\/sitemap/
+  // sitemap
+];
+var requireAuthMiddleware = createRule9({
+  name: "require-auth-middleware",
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Require authentication middleware on Express/Fastify route definitions. AI tools frequently generate route handlers without auth middleware, creating unprotected endpoints that expose sensitive data or operations."
+    },
+    fixable: void 0,
+    schema: [
+      {
+        type: "object",
+        properties: {
+          authMiddlewareNames: {
+            type: "array",
+            items: { type: "string" },
+            description: "Additional custom middleware names to recognize as authentication middleware."
+          }
+        },
+        additionalProperties: false
+      }
+    ],
+    messages: {
+      missingAuth: "Route `{{method}} {{path}}` appears to have no authentication middleware. AI tools frequently generate routes without auth checks, creating unprotected endpoints. Add authentication middleware (e.g., `protect`, `authenticate`) to the handler chain."
+    }
+  },
+  defaultOptions: [{}],
+  create(context, [options]) {
+    const customNames = new Set(options.authMiddlewareNames ?? []);
+    const allAuthNames = /* @__PURE__ */ new Set([...DEFAULT_AUTH_MIDDLEWARE_NAMES, ...customNames]);
+    let hasRouterUseAuth = false;
+    return {
+      CallExpression(node) {
+        if (isRouterUseAuth(node, allAuthNames)) {
+          hasRouterUseAuth = true;
+          return;
+        }
+        if (!isRouteDefinition(node)) return;
+        if (hasRouterUseAuth) return;
+        const callee = node.callee;
+        const method = callee.property.name;
+        const args = node.arguments;
+        if (args.length < 2) return;
+        const pathArg = args[0];
+        const pathStr = getPathString(pathArg);
+        if (pathStr && isPublicRoute(pathStr)) return;
+        const middlewareArgs = args.slice(1, -1);
+        if (middlewareArgs.length === 0 && args.length === 2) {
+          context.report({
+            node,
+            messageId: "missingAuth",
+            data: {
+              method: method.toUpperCase(),
+              path: pathStr || "<dynamic>"
+            }
+          });
+          return;
+        }
+        const hasAuth = middlewareArgs.some((arg) => isAuthMiddleware(arg, allAuthNames));
+        if (!hasAuth) {
+          context.report({
+            node,
+            messageId: "missingAuth",
+            data: {
+              method: method.toUpperCase(),
+              path: pathStr || "<dynamic>"
+            }
+          });
+        }
+      }
+    };
+  }
+});
+function isRouteDefinition(node) {
+  if (node.callee.type !== import_utils9.AST_NODE_TYPES.MemberExpression) return false;
+  if (node.callee.property.type !== import_utils9.AST_NODE_TYPES.Identifier) return false;
+  const methodName = node.callee.property.name;
+  if (!HTTP_METHODS.has(methodName)) return false;
+  const obj = node.callee.object;
+  if (obj.type === import_utils9.AST_NODE_TYPES.Identifier) {
+    const name = obj.name.toLowerCase();
+    return name === "router" || name === "app" || name.includes("router");
+  }
+  if (obj.type === import_utils9.AST_NODE_TYPES.CallExpression) return true;
+  return false;
+}
+function isRouterUseAuth(node, authNames) {
+  if (node.callee.type !== import_utils9.AST_NODE_TYPES.MemberExpression) return false;
+  if (node.callee.property.type !== import_utils9.AST_NODE_TYPES.Identifier) return false;
+  if (node.callee.property.name !== "use") return false;
+  return node.arguments.some((arg) => isAuthMiddleware(arg, authNames));
+}
+function isAuthMiddleware(node, authNames) {
+  if (node.type === import_utils9.AST_NODE_TYPES.Identifier) {
+    return authNames.has(node.name);
+  }
+  if (node.type === import_utils9.AST_NODE_TYPES.CallExpression) {
+    if (node.callee.type === import_utils9.AST_NODE_TYPES.Identifier) {
+      return authNames.has(node.callee.name);
+    }
+    if (node.callee.type === import_utils9.AST_NODE_TYPES.MemberExpression && node.callee.object.type === import_utils9.AST_NODE_TYPES.Identifier && node.callee.property.type === import_utils9.AST_NODE_TYPES.Identifier) {
+      const fullName = `${node.callee.object.name}.${node.callee.property.name}`;
+      return authNames.has(fullName) || authNames.has(node.callee.property.name);
+    }
+  }
+  return false;
+}
+function getPathString(node) {
+  if (node.type === import_utils9.AST_NODE_TYPES.Literal && typeof node.value === "string") {
+    return node.value;
+  }
+  if (node.type === import_utils9.AST_NODE_TYPES.TemplateLiteral) {
+    if (node.expressions.length === 0 && node.quasis.length === 1) {
+      return node.quasis[0].value.cooked ?? null;
+    }
+    if (node.quasis.length > 0) {
+      return node.quasis[0].value.cooked ?? null;
+    }
+  }
+  return null;
+}
+function isPublicRoute(pathStr) {
+  return PUBLIC_ROUTE_PATTERNS.some((pattern) => pattern.test(pathStr));
+}
+
+// src/rules/index.ts
+var allRules = {
+  "no-empty-catch": noEmptyCatch,
+  "no-broad-exception": noBroadException,
+  "no-async-array-callback": noAsyncArrayCallback,
+  "no-floating-promise": noFloatingPromise,
+  "no-await-in-loop": noAwaitInLoop,
+  "no-hardcoded-secret": noHardcodedSecret,
+  "no-eval-dynamic": noEvalDynamic,
+  "no-sql-string-concat": noSqlStringConcat,
+  "require-auth-middleware": requireAuthMiddleware
+};
+
+// src/configs/recommended.ts
+var recommended = {
+  plugins: ["ai-guard"],
+  rules: {
+    // Error Handling
+    "ai-guard/no-empty-catch": "error",
+    "ai-guard/no-broad-exception": "warn",
+    // Async
+    "ai-guard/no-async-array-callback": "error",
+    "ai-guard/no-floating-promise": "error",
+    "ai-guard/no-await-in-loop": "warn",
+    // Security
+    "ai-guard/no-hardcoded-secret": "error",
+    "ai-guard/no-eval-dynamic": "error",
+    "ai-guard/no-sql-string-concat": "error",
+    "ai-guard/require-auth-middleware": "warn"
+  }
+};
+var recommended_default = recommended;
+
+// src/configs/strict.ts
+var strict = {
+  plugins: ["ai-guard"],
+  rules: {
+    // Error Handling - all at error
+    "ai-guard/no-empty-catch": "error",
+    "ai-guard/no-broad-exception": "error",
+    // Async - all at error
+    "ai-guard/no-async-array-callback": "error",
+    "ai-guard/no-floating-promise": "error",
+    "ai-guard/no-await-in-loop": "error",
+    // Security - all at error
+    "ai-guard/no-hardcoded-secret": "error",
+    "ai-guard/no-eval-dynamic": "error",
+    "ai-guard/no-sql-string-concat": "error",
+    "ai-guard/require-auth-middleware": "error"
+  }
+};
+var strict_default = strict;
+
+// src/configs/security.ts
+var security = {
+  plugins: ["ai-guard"],
+  rules: {
+    "ai-guard/no-hardcoded-secret": "error",
+    "ai-guard/no-eval-dynamic": "error",
+    "ai-guard/no-sql-string-concat": "error",
+    "ai-guard/require-auth-middleware": "error"
+  }
+};
+var security_default = security;
+
+// src/index.ts
+var plugin = {
+  meta: {
+    name: "eslint-plugin-ai-guard",
+    version: "1.0.0"
+  },
+  rules: allRules,
+  configs: {
+    recommended: recommended_default,
+    strict: strict_default,
+    security: security_default
+  }
+};
+var index_default = plugin;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  recommended,
+  rules,
+  security,
+  strict
+});
+//# sourceMappingURL=index.js.map