eslint-plugin-ai-guard 1.2.0 → 1.2.2

package/dist/index.mjs

@@ -1,3 +1,10 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
 // src/rules/reliability/no-empty-catch.ts
 import { ESLintUtils } from "@typescript-eslint/utils";
 var createRule = ESLintUtils.RuleCreator(
@@ -1933,6 +1940,25 @@ import { ESLintUtils as ESLintUtils13, AST_NODE_TYPES as AST_NODE_TYPES12 } from
 var createRule13 = ESLintUtils13.RuleCreator(
   (name) => `https://github.com/YashJadhav21/eslint-plugin-ai-guard/blob/main/docs/rules/${name}.md`
 );
+var INTERNAL_FILE_PATTERNS = [
+  /[\\/]debug[\\/]/i,
+  /[\\/]scripts[\\/]/i,
+  /[\\/]tools[\\/]/i,
+  /[\\/]migrations?[\\/]/i,
+  /[\\/]seeds?[\\/]/i,
+  /[\\/]fixtures[\\/]/i,
+  /check[-_]server/i,
+  /debug[-_]server/i,
+  /diagnostics/i,
+  /seed\./i,
+  /migrate?\./i,
+  /setup\./i,
+  /scaffold\./i,
+  /test[-_].*\.js$/i
+];
+function isInternalToolingFile(filePath) {
+  return INTERNAL_FILE_PATTERNS.some((p) => p.test(filePath));
+}
 var UNTRUSTED_IDENTIFIER_NAMES = [
   "input",
   "userInput",
@@ -1974,11 +2000,13 @@ var noUnsafeDeserialize = createRule13({
     fixable: void 0,
     schema: [],
     messages: {
-      unsafeDeserialize: "Potential unsafe deserialization: JSON.parse() is used on likely untrusted input without visible schema validation. AI tools frequently generate this shortcut. Validate input before parsing."
+      unsafeDeserialize: "JSON.parse() on likely untrusted input without visible schema validation. Validate or sanitize the input before parsing to prevent deserialization of unexpected data."
     }
   },
   defaultOptions: [],
   create(context) {
+    const filePath = context.filename ?? context.getFilename?.() ?? "";
+    if (isInternalToolingFile(filePath)) return {};
     return {
       CallExpression(node) {
         if (!isJsonParseCall(node)) {
@@ -2035,8 +2063,8 @@ var DEFAULT_AUTH_MIDDLEWARE_NAMES = /* @__PURE__ */ new Set([
   "requireSession"
 ]);
 var PUBLIC_ROUTE_PATTERNS = [
-  /^\/?$/,
-  // '/' root
+  /^\/?\s*$/,
+  // '/' root or empty
   /^\*$/,
   // '*' SPA fallback
   /^\/\*$/,
@@ -2047,12 +2075,20 @@ var PUBLIC_ROUTE_PATTERNS = [
   // ping
   /^\/status/,
   // status
+  /^\/metrics/,
+  // Prometheus metrics
+  /^\/ready/,
+  // readiness probe
+  /^\/live/,
+  // liveness probe
   /^\/api\/v\d+\/auth/,
-  // auth routes
+  // versioned auth routes
   /^\/auth/,
   // auth routes
   /^\/login/,
   // login
+  /^\/logout/,
+  // logout
   /^\/register/,
   // register
   /^\/signup/,
@@ -2061,8 +2097,10 @@ var PUBLIC_ROUTE_PATTERNS = [
   // forgot password
   /^\/reset/,
   // reset password
+  /^\/verify/,
+  // email verification
   /^\/webhook/,
-  // webhooks
+  // webhooks (typically verified by signature)
   /^\/callback/,
   // OAuth callback
   /^\/public/,
@@ -2079,15 +2117,62 @@ var PUBLIC_ROUTE_PATTERNS = [
   // sitemap
   /^\/api\/docs/,
   // API documentation (Swagger, etc.)
-  /^\/docs/
+  /^\/docs/,
   // documentation
+  /^\/swagger/,
+  // Swagger UI
+  /^\/graphql/,
+  // GraphQL (handles own auth)
+  /^\/debug/,
+  // debug endpoints
+  /^\/diagnostics/,
+  // diagnostics endpoints
+  /^\/internal/,
+  // internal routes
+  /^\/dev/
+  // dev-only routes
+];
+var ELECTRON_PATH_PATTERNS = [
+  /[\\/]electron[\\/]/i,
+  /[\\/]electron-main/i,
+  /[\\/]electron-preload/i,
+  /\bmain\.js$/,
+  /\bpreload\.js$/,
+  /\bbackground\.js$/,
+  /\belectron\.js$/
+];
+var INTERNAL_SCRIPT_PATTERNS = [
+  /[\\/]scripts[\\/]/i,
+  /[\\/]tools[\\/]/i,
+  /[\\/]migrations?[\\/]/i,
+  /[\\/]seeds?[\\/]/i,
+  /[\\/]fixtures[\\/]/i,
+  /[\\/]dev[\\/]/i,
+  /[\\/]debug[\\/]/i,
+  /[\\/]diagnostics[\\/]/i,
+  /\bdebug[-_]server/i,
+  /\bdev[-_]server/i,
+  /\bcheck[-_]server/i,
+  /\blocal[-_]server/i,
+  /\bseed\./i,
+  /\bmigrate?\./i,
+  /\bsetup\./i,
+  /\bscaffold\./i,
+  /\binit\./i,
+  /\bbootstrap\./i
 ];
+function isElectronFile(filePath) {
+  return ELECTRON_PATH_PATTERNS.some((p) => p.test(filePath));
+}
+function isInternalScript(filePath) {
+  return INTERNAL_SCRIPT_PATTERNS.some((p) => p.test(filePath));
+}
 var requireAuthMiddleware = createRule14({
   name: "require-auth-middleware",
   meta: {
     type: "suggestion",
     docs: {
-      description: "Require authentication middleware on Express/Fastify route definitions. AI tools frequently generate route handlers without auth middleware, creating unprotected endpoints that expose sensitive data or operations."
+      description: "Require authentication middleware on Express/Fastify route definitions. AI tools frequently generate route handlers without auth middleware, creating unprotected endpoints."
     },
     fixable: void 0,
     schema: [
@@ -2098,19 +2183,45 @@ var requireAuthMiddleware = createRule14({
             type: "array",
             items: { type: "string" },
             description: "Additional custom middleware names to recognize as authentication middleware."
+          },
+          allowElectronApps: {
+            type: "boolean",
+            description: "Suppress findings in Electron main/preload files (default: true). Electron localhost routes do not need web auth middleware."
+          },
+          allowInternalScripts: {
+            type: "boolean",
+            description: "Suppress findings in internal tooling files (migration, seed, debug, dev-server). These are never production-exposed (default: true)."
+          },
+          internalPathPatterns: {
+            type: "array",
+            items: { type: "string" },
+            description: "Additional file path patterns to treat as internal (suppressed)."
           }
         },
         additionalProperties: false
       }
     ],
     messages: {
-      missingAuth: "Route `{{method}} {{path}}` appears to have no authentication middleware. AI tools frequently generate routes without auth checks, creating unprotected endpoints. Add authentication middleware (e.g., `protect`, `authenticate`) to the handler chain."
+      missingAuth: "Route `{{method}} {{path}}` appears to lack authentication middleware. Verify that auth is applied at the router level, or add middleware (e.g., `protect`, `authenticate`) to the handler chain."
     }
   },
   defaultOptions: [{}],
   create(context, [options]) {
+    const allowElectronApps = options.allowElectronApps !== false;
+    const allowInternalScripts = options.allowInternalScripts !== false;
     const customNames = new Set(options.authMiddlewareNames ?? []);
     const allAuthNames = /* @__PURE__ */ new Set([...DEFAULT_AUTH_MIDDLEWARE_NAMES, ...customNames]);
+    const extraPatterns = (options.internalPathPatterns ?? []).map((p) => new RegExp(p, "i"));
+    const filePath = context.filename ?? context.getFilename?.() ?? "";
+    if (allowElectronApps && isElectronFile(filePath)) {
+      return {};
+    }
+    if (allowInternalScripts && isInternalScript(filePath)) {
+      return {};
+    }
+    if (extraPatterns.some((p) => p.test(filePath))) {
+      return {};
+    }
     let hasRouterUseAuth = false;
     return {
       CallExpression(node) {
@@ -2229,6 +2340,24 @@ var AUTHZ_HELPER_NAMES = [
   "canModify",
   "hasAccess"
 ];
+var ELECTRON_PATH_PATTERNS2 = [
+  /[\\/]electron[\\/]/i,
+  /[\\/]electron-main/i,
+  /preload\.js$/,
+  /background\.js$/
+];
+var INTERNAL_SCRIPT_PATTERNS2 = [
+  /[\\/]scripts[\\/]/i,
+  /[\\/]migrations?[\\/]/i,
+  /[\\/]seeds?[\\/]/i,
+  /[\\/]debug[\\/]/i,
+  /seed\./i,
+  /migrate?\./i,
+  /setup\./i
+];
+function isElectronOrInternalFile(filePath) {
+  return ELECTRON_PATH_PATTERNS2.some((p) => p.test(filePath)) || INTERNAL_SCRIPT_PATTERNS2.some((p) => p.test(filePath));
+}
 function isRouteRegistrationCall(node) {
   if (node.callee.type !== AST_NODE_TYPES14.MemberExpression || node.callee.property.type !== AST_NODE_TYPES14.Identifier) {
     return false;
@@ -2269,29 +2398,29 @@ function getMemberPath(node) {
   }
   return [...objectPath, node.property.name];
 }
-function hasPathPrefix(path3, prefix) {
-  if (!path3 || path3.length < prefix.length) {
+function hasPathPrefix(path4, prefix) {
+  if (!path4 || path4.length < prefix.length) {
     return false;
   }
   for (let i = 0; i < prefix.length; i += 1) {
-    if (path3[i] !== prefix[i]) {
+    if (path4[i] !== prefix[i]) {
       return false;
     }
   }
   return true;
 }
-function isLikelyResourceIdPath(path3) {
-  if (!path3 || path3.length < 3) {
+function isLikelyResourceIdPath(path4) {
+  if (!path4 || path4.length < 3) {
     return false;
   }
-  if (!hasPathPrefix(path3, ["req", "params"]) && !hasPathPrefix(path3, ["req", "body"]) && !hasPathPrefix(path3, ["req", "query"])) {
+  if (!hasPathPrefix(path4, ["req", "params"]) && !hasPathPrefix(path4, ["req", "body"]) && !hasPathPrefix(path4, ["req", "query"])) {
     return false;
   }
-  const last = path3[path3.length - 1].toLowerCase();
+  const last = path4[path4.length - 1].toLowerCase();
   return last === "id" || last.endsWith("id");
 }
-function isReqUserPath(path3) {
-  return hasPathPrefix(path3, ["req", "user"]);
+function isReqUserPath(path4) {
+  return hasPathPrefix(path4, ["req", "user"]);
 }
 function containsAuthorizationHelper(node) {
   if (node.type === AST_NODE_TYPES14.CallExpression && (node.callee.type === AST_NODE_TYPES14.Identifier && AUTHZ_HELPER_NAMES.includes(node.callee.name) || node.callee.type === AST_NODE_TYPES14.MemberExpression && node.callee.property.type === AST_NODE_TYPES14.Identifier && AUTHZ_HELPER_NAMES.includes(node.callee.property.name))) {
@@ -2330,8 +2459,8 @@ function collectBodySignals(node) {
       }
     }
     if (current.type === AST_NODE_TYPES14.MemberExpression) {
-      const path3 = getMemberPath(current);
-      if (isLikelyResourceIdPath(path3)) {
+      const path4 = getMemberPath(current);
+      if (isLikelyResourceIdPath(path4)) {
         hasResourceIdAccess = true;
       }
     }
@@ -2367,11 +2496,13 @@ var requireAuthzCheck = createRule15({
     fixable: void 0,
     schema: [],
     messages: {
-      missingAuthz: "Potential missing authorization check. This handler uses resource identifiers (like req.params.id) but no visible ownership/authorization guard was found. AI tools frequently miss authz after auth."
+      missingAuthz: "Handler accesses resource identifiers (e.g., req.params.id) without a visible authorization check. Verify ownership or permission is enforced before the resource is returned or modified."
     }
   },
   defaultOptions: [],
   create(context) {
+    const filePath = context.filename ?? context.getFilename?.() ?? "";
+    if (isElectronOrInternalFile(filePath)) return {};
     return {
       CallExpression(node) {
         if (!isRouteRegistrationCall(node)) {
@@ -2788,10 +2919,23 @@ var security = {
 var security_default = security;
 
 // src/index.ts
+import { createRequire } from "module";
+import { fileURLToPath } from "url";
+import path3 from "path";
+var pkgVersion = "1.2.2";
+try {
+  const require_ = typeof __require !== "undefined" ? __require : createRequire(import.meta.url);
+  const isESM = typeof __dirname === "undefined";
+  const dirname = isESM ? path3.dirname(fileURLToPath(import.meta.url)) : __dirname;
+  const pkgPath = path3.resolve(dirname, dirname.endsWith("src") ? "../package.json" : "../../package.json");
+  const pkg = require_(pkgPath);
+  if (pkg && pkg.version) pkgVersion = pkg.version;
+} catch {
+}
 var plugin = {
   meta: {
     name: "eslint-plugin-ai-guard",
-    version: "1.2.0"
+    version: pkgVersion
   },
   rules: allRules,
   configs: {