eslint-plugin-ai-guard 1.2.0 → 1.2.2

package/dist/index.d.mts

@@ -60,6 +60,9 @@ declare const allRules: {
     };
     readonly 'require-auth-middleware': _typescript_eslint_utils_ts_eslint.RuleModule<"missingAuth", [{
         authMiddlewareNames?: string[];
+        allowElectronApps?: boolean;
+        allowInternalScripts?: boolean;
+        internalPathPatterns?: string[];
     }], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
         name: string;
     };
@@ -130,6 +133,9 @@ declare const plugin: {
         };
         readonly 'require-auth-middleware': _typescript_eslint_utils_ts_eslint.RuleModule<"missingAuth", [{
             authMiddlewareNames?: string[];
+            allowElectronApps?: boolean;
+            allowInternalScripts?: boolean;
+            internalPathPatterns?: string[];
         }], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
             name: string;
         };

package/dist/index.d.ts

@@ -60,6 +60,9 @@ declare const allRules: {
     };
     readonly 'require-auth-middleware': _typescript_eslint_utils_ts_eslint.RuleModule<"missingAuth", [{
         authMiddlewareNames?: string[];
+        allowElectronApps?: boolean;
+        allowInternalScripts?: boolean;
+        internalPathPatterns?: string[];
     }], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
         name: string;
     };
@@ -130,6 +133,9 @@ declare const plugin: {
         };
         readonly 'require-auth-middleware': _typescript_eslint_utils_ts_eslint.RuleModule<"missingAuth", [{
             authMiddlewareNames?: string[];
+            allowElectronApps?: boolean;
+            allowInternalScripts?: boolean;
+            internalPathPatterns?: string[];
         }], unknown, _typescript_eslint_utils_ts_eslint.RuleListener> & {
             name: string;
         };

package/dist/index.js

@@ -1973,6 +1973,25 @@ var import_utils13 = require("@typescript-eslint/utils");
 var createRule13 = import_utils13.ESLintUtils.RuleCreator(
   (name) => `https://github.com/YashJadhav21/eslint-plugin-ai-guard/blob/main/docs/rules/${name}.md`
 );
+var INTERNAL_FILE_PATTERNS = [
+  /[\\/]debug[\\/]/i,
+  /[\\/]scripts[\\/]/i,
+  /[\\/]tools[\\/]/i,
+  /[\\/]migrations?[\\/]/i,
+  /[\\/]seeds?[\\/]/i,
+  /[\\/]fixtures[\\/]/i,
+  /check[-_]server/i,
+  /debug[-_]server/i,
+  /diagnostics/i,
+  /seed\./i,
+  /migrate?\./i,
+  /setup\./i,
+  /scaffold\./i,
+  /test[-_].*\.js$/i
+];
+function isInternalToolingFile(filePath) {
+  return INTERNAL_FILE_PATTERNS.some((p) => p.test(filePath));
+}
 var UNTRUSTED_IDENTIFIER_NAMES = [
   "input",
   "userInput",
@@ -2014,11 +2033,13 @@ var noUnsafeDeserialize = createRule13({
     fixable: void 0,
     schema: [],
     messages: {
-      unsafeDeserialize: "Potential unsafe deserialization: JSON.parse() is used on likely untrusted input without visible schema validation. AI tools frequently generate this shortcut. Validate input before parsing."
+      unsafeDeserialize: "JSON.parse() on likely untrusted input without visible schema validation. Validate or sanitize the input before parsing to prevent deserialization of unexpected data."
     }
   },
   defaultOptions: [],
   create(context) {
+    const filePath = context.filename ?? context.getFilename?.() ?? "";
+    if (isInternalToolingFile(filePath)) return {};
     return {
       CallExpression(node) {
         if (!isJsonParseCall(node)) {
@@ -2075,8 +2096,8 @@ var DEFAULT_AUTH_MIDDLEWARE_NAMES = /* @__PURE__ */ new Set([
   "requireSession"
 ]);
 var PUBLIC_ROUTE_PATTERNS = [
-  /^\/?$/,
-  // '/' root
+  /^\/?\s*$/,
+  // '/' root or empty
   /^\*$/,
   // '*' SPA fallback
   /^\/\*$/,
@@ -2087,12 +2108,20 @@ var PUBLIC_ROUTE_PATTERNS = [
   // ping
   /^\/status/,
   // status
+  /^\/metrics/,
+  // Prometheus metrics
+  /^\/ready/,
+  // readiness probe
+  /^\/live/,
+  // liveness probe
   /^\/api\/v\d+\/auth/,
-  // auth routes
+  // versioned auth routes
   /^\/auth/,
   // auth routes
   /^\/login/,
   // login
+  /^\/logout/,
+  // logout
   /^\/register/,
   // register
   /^\/signup/,
@@ -2101,8 +2130,10 @@ var PUBLIC_ROUTE_PATTERNS = [
   // forgot password
   /^\/reset/,
   // reset password
+  /^\/verify/,
+  // email verification
   /^\/webhook/,
-  // webhooks
+  // webhooks (typically verified by signature)
   /^\/callback/,
   // OAuth callback
   /^\/public/,
@@ -2119,15 +2150,62 @@ var PUBLIC_ROUTE_PATTERNS = [
   // sitemap
   /^\/api\/docs/,
   // API documentation (Swagger, etc.)
-  /^\/docs/
+  /^\/docs/,
   // documentation
+  /^\/swagger/,
+  // Swagger UI
+  /^\/graphql/,
+  // GraphQL (handles own auth)
+  /^\/debug/,
+  // debug endpoints
+  /^\/diagnostics/,
+  // diagnostics endpoints
+  /^\/internal/,
+  // internal routes
+  /^\/dev/
+  // dev-only routes
 ];
+var ELECTRON_PATH_PATTERNS = [
+  /[\\/]electron[\\/]/i,
+  /[\\/]electron-main/i,
+  /[\\/]electron-preload/i,
+  /\bmain\.js$/,
+  /\bpreload\.js$/,
+  /\bbackground\.js$/,
+  /\belectron\.js$/
+];
+var INTERNAL_SCRIPT_PATTERNS = [
+  /[\\/]scripts[\\/]/i,
+  /[\\/]tools[\\/]/i,
+  /[\\/]migrations?[\\/]/i,
+  /[\\/]seeds?[\\/]/i,
+  /[\\/]fixtures[\\/]/i,
+  /[\\/]dev[\\/]/i,
+  /[\\/]debug[\\/]/i,
+  /[\\/]diagnostics[\\/]/i,
+  /\bdebug[-_]server/i,
+  /\bdev[-_]server/i,
+  /\bcheck[-_]server/i,
+  /\blocal[-_]server/i,
+  /\bseed\./i,
+  /\bmigrate?\./i,
+  /\bsetup\./i,
+  /\bscaffold\./i,
+  /\binit\./i,
+  /\bbootstrap\./i
+];
+function isElectronFile(filePath) {
+  return ELECTRON_PATH_PATTERNS.some((p) => p.test(filePath));
+}
+function isInternalScript(filePath) {
+  return INTERNAL_SCRIPT_PATTERNS.some((p) => p.test(filePath));
+}
 var requireAuthMiddleware = createRule14({
   name: "require-auth-middleware",
   meta: {
     type: "suggestion",
     docs: {
-      description: "Require authentication middleware on Express/Fastify route definitions. AI tools frequently generate route handlers without auth middleware, creating unprotected endpoints that expose sensitive data or operations."
+      description: "Require authentication middleware on Express/Fastify route definitions. AI tools frequently generate route handlers without auth middleware, creating unprotected endpoints."
     },
     fixable: void 0,
     schema: [
@@ -2138,19 +2216,45 @@ var requireAuthMiddleware = createRule14({
             type: "array",
             items: { type: "string" },
             description: "Additional custom middleware names to recognize as authentication middleware."
+          },
+          allowElectronApps: {
+            type: "boolean",
+            description: "Suppress findings in Electron main/preload files (default: true). Electron localhost routes do not need web auth middleware."
+          },
+          allowInternalScripts: {
+            type: "boolean",
+            description: "Suppress findings in internal tooling files (migration, seed, debug, dev-server). These are never production-exposed (default: true)."
+          },
+          internalPathPatterns: {
+            type: "array",
+            items: { type: "string" },
+            description: "Additional file path patterns to treat as internal (suppressed)."
           }
         },
         additionalProperties: false
       }
     ],
     messages: {
-      missingAuth: "Route `{{method}} {{path}}` appears to have no authentication middleware. AI tools frequently generate routes without auth checks, creating unprotected endpoints. Add authentication middleware (e.g., `protect`, `authenticate`) to the handler chain."
+      missingAuth: "Route `{{method}} {{path}}` appears to lack authentication middleware. Verify that auth is applied at the router level, or add middleware (e.g., `protect`, `authenticate`) to the handler chain."
     }
   },
   defaultOptions: [{}],
   create(context, [options]) {
+    const allowElectronApps = options.allowElectronApps !== false;
+    const allowInternalScripts = options.allowInternalScripts !== false;
     const customNames = new Set(options.authMiddlewareNames ?? []);
     const allAuthNames = /* @__PURE__ */ new Set([...DEFAULT_AUTH_MIDDLEWARE_NAMES, ...customNames]);
+    const extraPatterns = (options.internalPathPatterns ?? []).map((p) => new RegExp(p, "i"));
+    const filePath = context.filename ?? context.getFilename?.() ?? "";
+    if (allowElectronApps && isElectronFile(filePath)) {
+      return {};
+    }
+    if (allowInternalScripts && isInternalScript(filePath)) {
+      return {};
+    }
+    if (extraPatterns.some((p) => p.test(filePath))) {
+      return {};
+    }
     let hasRouterUseAuth = false;
     return {
       CallExpression(node) {
@@ -2269,6 +2373,24 @@ var AUTHZ_HELPER_NAMES = [
   "canModify",
   "hasAccess"
 ];
+var ELECTRON_PATH_PATTERNS2 = [
+  /[\\/]electron[\\/]/i,
+  /[\\/]electron-main/i,
+  /preload\.js$/,
+  /background\.js$/
+];
+var INTERNAL_SCRIPT_PATTERNS2 = [
+  /[\\/]scripts[\\/]/i,
+  /[\\/]migrations?[\\/]/i,
+  /[\\/]seeds?[\\/]/i,
+  /[\\/]debug[\\/]/i,
+  /seed\./i,
+  /migrate?\./i,
+  /setup\./i
+];
+function isElectronOrInternalFile(filePath) {
+  return ELECTRON_PATH_PATTERNS2.some((p) => p.test(filePath)) || INTERNAL_SCRIPT_PATTERNS2.some((p) => p.test(filePath));
+}
 function isRouteRegistrationCall(node) {
   if (node.callee.type !== import_utils15.AST_NODE_TYPES.MemberExpression || node.callee.property.type !== import_utils15.AST_NODE_TYPES.Identifier) {
     return false;
@@ -2309,29 +2431,29 @@ function getMemberPath(node) {
   }
   return [...objectPath, node.property.name];
 }
-function hasPathPrefix(path3, prefix) {
-  if (!path3 || path3.length < prefix.length) {
+function hasPathPrefix(path4, prefix) {
+  if (!path4 || path4.length < prefix.length) {
     return false;
   }
   for (let i = 0; i < prefix.length; i += 1) {
-    if (path3[i] !== prefix[i]) {
+    if (path4[i] !== prefix[i]) {
       return false;
     }
   }
   return true;
 }
-function isLikelyResourceIdPath(path3) {
-  if (!path3 || path3.length < 3) {
+function isLikelyResourceIdPath(path4) {
+  if (!path4 || path4.length < 3) {
     return false;
   }
-  if (!hasPathPrefix(path3, ["req", "params"]) && !hasPathPrefix(path3, ["req", "body"]) && !hasPathPrefix(path3, ["req", "query"])) {
+  if (!hasPathPrefix(path4, ["req", "params"]) && !hasPathPrefix(path4, ["req", "body"]) && !hasPathPrefix(path4, ["req", "query"])) {
     return false;
   }
-  const last = path3[path3.length - 1].toLowerCase();
+  const last = path4[path4.length - 1].toLowerCase();
   return last === "id" || last.endsWith("id");
 }
-function isReqUserPath(path3) {
-  return hasPathPrefix(path3, ["req", "user"]);
+function isReqUserPath(path4) {
+  return hasPathPrefix(path4, ["req", "user"]);
 }
 function containsAuthorizationHelper(node) {
   if (node.type === import_utils15.AST_NODE_TYPES.CallExpression && (node.callee.type === import_utils15.AST_NODE_TYPES.Identifier && AUTHZ_HELPER_NAMES.includes(node.callee.name) || node.callee.type === import_utils15.AST_NODE_TYPES.MemberExpression && node.callee.property.type === import_utils15.AST_NODE_TYPES.Identifier && AUTHZ_HELPER_NAMES.includes(node.callee.property.name))) {
@@ -2370,8 +2492,8 @@ function collectBodySignals(node) {
       }
     }
     if (current.type === import_utils15.AST_NODE_TYPES.MemberExpression) {
-      const path3 = getMemberPath(current);
-      if (isLikelyResourceIdPath(path3)) {
+      const path4 = getMemberPath(current);
+      if (isLikelyResourceIdPath(path4)) {
         hasResourceIdAccess = true;
       }
     }
@@ -2407,11 +2529,13 @@ var requireAuthzCheck = createRule15({
     fixable: void 0,
     schema: [],
     messages: {
-      missingAuthz: "Potential missing authorization check. This handler uses resource identifiers (like req.params.id) but no visible ownership/authorization guard was found. AI tools frequently miss authz after auth."
+      missingAuthz: "Handler accesses resource identifiers (e.g., req.params.id) without a visible authorization check. Verify ownership or permission is enforced before the resource is returned or modified."
     }
   },
   defaultOptions: [],
   create(context) {
+    const filePath = context.filename ?? context.getFilename?.() ?? "";
+    if (isElectronOrInternalFile(filePath)) return {};
     return {
       CallExpression(node) {
         if (!isRouteRegistrationCall(node)) {
@@ -2828,10 +2952,24 @@ var security = {
 var security_default = security;
 
 // src/index.ts
+var import_module = require("module");
+var import_url = require("url");
+var import_path3 = __toESM(require("path"));
+var import_meta = {};
+var pkgVersion = "1.2.2";
+try {
+  const require_ = typeof require !== "undefined" ? require : (0, import_module.createRequire)(import_meta.url);
+  const isESM = typeof __dirname === "undefined";
+  const dirname = isESM ? import_path3.default.dirname((0, import_url.fileURLToPath)(import_meta.url)) : __dirname;
+  const pkgPath = import_path3.default.resolve(dirname, dirname.endsWith("src") ? "../package.json" : "../../package.json");
+  const pkg = require_(pkgPath);
+  if (pkg && pkg.version) pkgVersion = pkg.version;
+} catch {
+}
 var plugin = {
   meta: {
     name: "eslint-plugin-ai-guard",
-    version: "1.2.0"
+    version: pkgVersion
   },
   rules: allRules,
   configs: {