fini-proof 0.3.0

package/src/engines/skip-ratchet.mjs

@@ -0,0 +1,78 @@
+// fini-proof engine: skip-ratchet — focused (.only) tests and a ratchet on skipped tests.
+// REUSED from Finipe: the skip call shapes (SKIP_RE, conditional-skip shapes) and the SKIP-LEDGER convention
+// (a `SKIP-LEDGER: <ref>` comment on the skip's line or the 3 lines above exempts it) come from the ported F4
+// detector (./vendor/vacuous-spec-core.mjs); the ratchet semantics (a count may only go down, a baseline is
+// never raised silently) follow finipe scripts/ci/fini-rule-ratchet.mjs @ 4ac53b367. Python skip shapes and the
+// .only rule are NEW.
+import { maskStringsAndComments, skipLacksLedgerEntry, conditionalSkipOffsets } from './vendor/vacuous-spec-core.mjs'
+
+const JS_TEST_RE = /(^|\/)(__tests__\/.*\.(js|jsx|ts|tsx|mjs|cjs)$|[^/]+\.(spec|test)\.(js|jsx|ts|tsx|mjs|cjs)$)/
+const PY_TEST_RE = /(^|\/)(test_[^/]*\.py|[^/]*_test\.py|conftest\.py)$/
+const ONLY_RE = /\b(?:it|test|describe|context|suite)\s*\.\s*only\s*\(|(?<![.\w$])(?:fit|fdescribe|ftest)\s*\(/g
+const SKIP_RE = /\b(?:it|test|describe|context|suite)\s*\.\s*(?:skip|todo)\s*\(|(?<![.\w$])(?:xit|xtest|xdescribe)\s*\(/g
+const PY_SKIP_RE = /@pytest\.mark\.(?:skip|skipif|xfail)\b|@unittest\.(?:skip|skipIf|skipUnless|expectedFailure)\b|\bpytest\.skip\s*\(|\bself\.skipTest\s*\(/g
+
+function lineOf(src, idx) { return src.slice(0, idx).split('\n').length }
+
+export default {
+  id: 'skip-ratchet',
+  version: '0.1.0',
+  title: 'Focused and skipped tests (ratchet)',
+  provenance: 'finipe check-vacuous-spec.mjs skip shapes + SKIP-LEDGER, fini-rule-ratchet.mjs semantics @ 4ac53b367',
+  appliesTo: (rel) => JS_TEST_RE.test(rel) || PY_TEST_RE.test(rel),
+  scanFile(rel, content) {
+    const out = []
+    const isPy = rel.endsWith('.py')
+    const masked = isPy ? content.replace(/#.*$/gm, (m) => ' '.repeat(m.length)) : maskStringsAndComments(content)
+    if (!isPy) {
+      let m
+      ONLY_RE.lastIndex = 0
+      while ((m = ONLY_RE.exec(masked)) !== null) out.push({ line: lineOf(content, m.index), rule: 'FOCUSED_TEST', severity: 'high', message: '`.only` / `fit` / `fdescribe` makes the runner skip every OTHER test in the file (or the run) — the suite goes green having run almost nothing. FIX: remove the focus before merging.' })
+    }
+    const skips = new Set()
+    const re = isPy ? PY_SKIP_RE : SKIP_RE
+    re.lastIndex = 0
+    let m
+    while ((m = re.exec(masked)) !== null) skips.add(lineOf(content, m.index))
+    if (!isPy) for (const at of conditionalSkipOffsets(masked)) skips.add(lineOf(content, at))
+    for (const line of [...skips].sort((a, b) => a - b)) {
+      if (!skipLacksLedgerEntry(content, line)) continue
+      out.push({ line, rule: 'SKIPPED_TEST', severity: 'info', message: 'skipped test with no `SKIP-LEDGER: <ref>` comment saying why and where that decision is recorded.' })
+    }
+    return out
+  },
+  /** Ratchet: per file, unledgered skips above the committed baseline become SKIP_RATCHET (high). */
+  finalize(findings, ctx) {
+    const base = ctx.baseline?.['skip-ratchet'] || {}
+    const byFile = new Map()
+    for (const f of findings) if (f.rule === 'SKIPPED_TEST') byFile.set(f.file, (byFile.get(f.file) || 0) + 1)
+    const tolerated = {}
+    const out = []
+    for (const f of findings) {
+      if (f.rule !== 'SKIPPED_TEST') { out.push(f); continue }
+      const n = byFile.get(f.file), allowed = base[f.file] || 0
+      if (n > allowed) out.push({ ...f, rule: 'SKIP_RATCHET', severity: 'high', message: `${f.file} now has ${n} unledgered skipped test(s); the baseline allows ${allowed}. A skip hides a test without anyone deciding to. FIX: un-skip it, or add \`// SKIP-LEDGER: <ticket>\` naming why.` })
+      else tolerated[f.file] = n
+    }
+    return { findings: out, measurements: { skipsPerFile: Object.fromEntries(byFile), toleratedByBaseline: tolerated } }
+  },
+  rules: {
+    FOCUSED_TEST: { severity: 'high', summary: '`.only` / `fit` makes the runner skip every other test', fix: 'remove the focus' },
+    SKIPPED_TEST: { severity: 'info', summary: 'a skipped test with no `SKIP-LEDGER: <ref>` reason (tolerated up to the baseline)', fix: 'un-skip, or add a SKIP-LEDGER comment' },
+    SKIP_RATCHET: { severity: 'high', summary: 'more unledgered skipped tests than the committed baseline allows', fix: 'un-skip, or add `// SKIP-LEDGER: <ticket>`' },
+  },
+  negativeControls: [
+    { id: 'skip-ratchet/NC-1', file: 'nc/a.test.js', expect: 'FOCUSED_TEST', content: "it.only('runs alone', () => {\n  expect(f()).toBe(1)\n})\nit('never runs', () => { expect(g()).toBe(2) })\n" },
+    { id: 'skip-ratchet/NC-2', file: 'nc/b.spec.ts', expect: 'SKIP_RATCHET', content: "it.skip('pays the vendor', () => {\n  expect(pay()).toBe(true)\n})\n" },
+    { id: 'skip-ratchet/NC-3', file: 'nc/test_c.py', expect: 'SKIP_RATCHET', content: '@pytest.mark.skip\ndef test_refund():\n    assert refund() == 10\n' },
+  ],
+  // Positive controls: `rule` names the rule each is the nearest clean look-alike for.
+  positiveControls: [
+    { id: 'skip-ratchet/PC-1', rule: 'SKIP_RATCHET', file: 'pc/a.test.js', content: "// SKIP-LEDGER: JIRA-123 flaky upstream sandbox\nit.skip('sandbox', () => { expect(x()).toBe(1) })\nconst s = 'it.only(' \n" },
+    { id: 'skip-ratchet/PC-2', rule: 'FOCUSED_TEST', file: 'pc/b.test.js', content: "// use it.only( locally, never commit it\nit('runs with the others', () => {\n  expect(f()).toBe(1)\n})\nconst focus = 'fdescribe'\n" },
+    // SKIPPED_TEST has no negative control on purpose: finalize() never emits it as a finding (a skip within the
+    // baseline is recorded in measurements.toleratedByBaseline; above it, it becomes SKIP_RATCHET). It is info →
+    // ADVISORY in `state`, never PROVEN.
+    { id: 'skip-ratchet/PC-3', rule: 'SKIP_RATCHET', file: 'pc/test_d.py', content: '# SKIP-LEDGER: JIRA-77 bank sandbox down until 2026-10-15\n@pytest.mark.skip\ndef test_payout():\n    assert payout() == 10\n' },
+  ],
+}

package/src/engines/tenant-filter.mjs

@@ -0,0 +1,516 @@
+// fini-proof engine: tenant-filter — a query on a multi-tenant table that does not filter by the tenant column,
+// so one customer's request can read or change another customer's rows (the #1 SaaS data-leak class).
+//
+// PROVENANCE. The detector shapes are ported from finipe .github/scripts/check-tenant-scoping.js
+// (blob ca97b5c1, last changed 990d528dd, read at finipe commit 4ac53b367):
+//   1. `.find({` / `.findOne({` whose options carry no tenantId / tenant_id          (checkFindWithoutTenant)
+//   2. `.createQueryBuilder(` whose chain never mentions the tenant                  (checkQueryBuilderWithoutTenant)
+//   3. a raw `SELECT` string with no tenant_id                                       (checkRawQueryWithoutTenant)
+// ADAPTED for customer repos: Finipe's fixed 10/15/20-line look-ahead windows are replaced by the call's balanced
+// argument list / the statement's own extent (a window lets the NEXT statement's tenantId hide a leak), Finipe's
+// hard-coded backend/src/modules path and allowlist become config, and a finding is only raised when the queried
+// table is KNOWN to be multi-tenant (detected from the repo's own schema, or configured) — Finipe flagged every
+// find() and ran as a warning-only trend script for that reason.
+// NEW: UPDATE/DELETE/JOIN raw SQL in any language, Prisma, Sequelize-style, Knex, Django ORM and SQLAlchemy shapes,
+// schema detection (SQL, Prisma, TypeORM, Knex, Alembic, Django/SQLAlchemy models), and the exemption comment
+// `fini-proof: tenant-exempt <reason>` (e.g. a platform-admin report that must read across tenants).
+//
+// Config (.fini-proof.json):  { "tenant": { "column": "tenant_id", "tables": ["orders"], "exemptTables": [],
+//                                          "exemptPaths": ["src/admin/**"],
+//                                          "helpers": ["buildTeamWhereQuery"], "scopeColumns": ["project_id"] } }
+// With no config the column is tenant_id (+ tenantId) and the tables are those whose schema declares that column.
+// v0.3 (false-positive pass on 3 public SaaS repos, see FP_MEASUREMENT report):
+//   - `helpers`: a call to a shared where-builder counts as the tenant condition (the filter lives in the helper);
+//   - `scopeColumns`: extra columns the team declares as tenant-scoping (a parent key such as project_id whose row
+//     is itself tenant-scoped, or the authenticated user for per-user data) — recorded in the evidence measurements;
+//   - tables with Postgres ROW LEVEL SECURITY enabled in the schema are isolated by the database and are not
+//     checked at the call site (listed as rlsTables in the evidence);
+//   - the table set comes from the DECLARATIVE schema (Prisma, ORM models/entities) when the repo has one — old
+//     migrations describe history (documenso: tables whose tenant column was later dropped were flagged); Python
+//     model classes inherit the tenant column from an abstract base (Django ProjectBaseModel → Issue, Cycle, …);
+//   - HIGH is kept only where there is no sign of a tenant check around the call. It is lowered to UNPROVEN (low,
+//     non-blocking by default, reason in the message) when the row is re-keyed from an already-loaded object
+//     (`id: envelope.id`), when the same table was queried WITH the tenant condition earlier in the same function,
+//     or when the result's tenant column is checked right after the fetch (`envelope.teamId` → access check);
+//   - calls on external SDK clients (stripe.subscriptions.update, s3.…) are not database queries;
+//   - Array.prototype.find/count(callback), correlated sub-queries (Django OuterRef) and prose strings that merely
+//     start with "Update …"/"Select …" are no longer read as queries.
+import { balanced } from './vendor/migration-invariants-core.mjs'
+import { maskStringsAndComments } from './vendor/vacuous-spec-core.mjs'
+import { globToRegExp } from '../files.mjs'
+import { MIGRATION_PATH_RE } from './migrations.mjs'
+
+const CODE_RE = /\.(js|jsx|ts|tsx|mjs|cjs|py|java|kt|go|rb|php|cs|sql)$/
+const TEST_RE = /(^|\/)(__tests__|__mocks__|tests?|spec|e2e|fixtures?|seeds?|seeders)\/|\.(spec|test|e2e|stories)\.[a-z]+$|(^|\/)test_[^/]*\.py$|_test\.(py|go)$|\.d\.ts$/
+const SCHEMA_RE = /(^|\/)(migrations?|migrate|alembic\/versions)\/|\.sql$|(^|\/)schema\.prisma$|\.entity\.(ts|js)$|(^|\/)(entities|entity|models?)\/[^/]+\.(ts|js|py)$|(^|\/)models\.py$|\.model\.(ts|js)$/i
+const JS_RE = /\.(js|jsx|ts|tsx|mjs|cjs)$/
+const lineOf = (src, idx) => src.slice(0, idx).split('\n').length
+const esc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+
+/** orders / Orders / order_items / OrderItem / "public"."orders" → one comparable key. */
+export function tableKey(name) {
+  let k = String(name).replace(/["'`[\]]/g, '').split('.').pop().toLowerCase().replace(/[^a-z0-9]/g, '')
+  if (k.endsWith('ies')) k = k.slice(0, -3) + 'y'
+  else if (k.endsWith('sses')) k = k.slice(0, -2)
+  else if (k.endsWith('s') && !k.endsWith('ss')) k = k.slice(0, -1)
+  return k
+}
+
+export function columnVariants(column) {
+  const snake = column.replace(/([a-z0-9])([A-Z])/g, '$1_$2').toLowerCase()
+  const camel = snake.replace(/_([a-z0-9])/g, (_, c) => c.toUpperCase())
+  const base = snake.replace(/_id$/, '')
+  return { names: [...new Set([column, snake, camel])], base }
+}
+
+/** Build the per-run context: which column means "tenant", which tables carry it. */
+export function tenantContext({ column = 'tenant_id', columns, tables = [], exemptTables = [], exemptPaths = [], helpers = [], scopeColumns = [] } = {}) {
+  const cols = (columns && columns.length ? columns : [column]).map(columnVariants)
+  const names = [...new Set(cols.flatMap((c) => c.names))]
+  const bases = [...new Set(cols.map((c) => c.base).filter((b) => b && !names.includes(b)))]
+  const colRe = new RegExp(`\\b(?:${names.map(esc).join('|')})\\b${bases.length ? `|\\b(?:${bases.map(esc).join('|')})(?:__\\w+)?\\s*(?:=|:)(?!=)` : ''}`, 'i')
+  const exempt = new Set(exemptTables.map(tableKey))
+  // a scope column `user` also means user_id / userId; `project_id` also means project / projectId
+  const scopeNames = [...new Set(scopeColumns.map(columnVariants).flatMap((c) => [...c.names, c.base, `${c.base}_id`, `${c.base}Id`]).filter(Boolean))]
+  const extra = [
+    ...(helpers.length ? [`\\b(?:${helpers.map(esc).join('|')})\\s*\\(`] : []),
+    // `{ token, }` shorthand counts; so does a Django relation path ending in it (project__projectmember__member=…)
+    ...(scopeNames.length ? [`(?:\\b|__)(?:${scopeNames.map(esc).join('|')})(?:__\\w+)?\\b\\s*(?:=|:|\\bIN\\b|,|\\})(?!=)`] : []),
+    // the parent row looked up by its own scope id: Project.objects.get(pk=project_id) / id=self.kwargs.get("project_id")
+    ...(scopeNames.length ? [`\\b(?:pk|id)\\s*[=:]\\s*(?:[\\w.]*\\(\\s*['"])?(?:${scopeNames.map(esc).join('|')})\\b`] : []),
+  ]
+  const scopeRe = extra.length ? new RegExp(extra.join('|'), 'i') : null
+  return {
+    columns: names,
+    colRe,
+    /** true when the text carries the tenant condition (column, a declared scope column, or a declared helper). */
+    scoped: (text) => colRe.test(text) || Boolean(scopeRe && scopeRe.test(text)),
+    declRe: new RegExp(`(?:^|[\\s,({'"\`])["'\`]?(?:${names.map(esc).join('|')}${bases.length ? `|${bases.map(esc).join('|')}` : ''})["'\`]?\\b`, 'i'),
+    tables: new Set(tables.map(tableKey).filter((k) => !exempt.has(k))),
+    tableNames: tables.filter((t) => !exempt.has(tableKey(t))),
+    exempt,
+    exemptPathRes: exemptPaths.map(globToRegExp),
+  }
+}
+
+/** Tables the schema puts under Postgres row-level security (the database enforces isolation, not the call site). */
+export function detectRlsTables(content) {
+  return [...content.matchAll(/ALTER\s+TABLE\s+(?:IF\s+EXISTS\s+)?(?:ONLY\s+)?((?:["`\w]+\.)?["`]?\w+["`]?)\s+(?:FORCE|ENABLE)\s+ROW\s+LEVEL\s+SECURITY/gi)]
+    .map((m) => m[1].replace(/["`]/g, '').split('.').pop())
+}
+
+/** Python model classes in this file: name, base class names, and the mapped table name. */
+export function pyModelClasses(content) {
+  const out = []
+  for (const m of content.matchAll(/^class\s+(\w+)\s*\(([^)]*)\)\s*:/gm)) {
+    const rest = content.slice(m.index + m[0].length)
+    const end = rest.search(/^\S/m)
+    const body = end < 0 ? rest : rest.slice(0, end)
+    const tn = /__tablename__\s*=\s*['"](\w+)/.exec(body) || /db_table\s*=\s*['"](\w+)/.exec(body)
+    out.push({ name: m[1], bases: m[2].split(',').map((b) => b.trim().split('.').pop()).filter(Boolean), table: tn ? tn[1] : null })
+  }
+  return out
+}
+
+const DECLARATIVE_RE = /(^|\/)schema\.prisma$|\.entity\.(ts|js)$|(^|\/)(entities|entity|models?)\/[^/]+\.(ts|js|py)$|(^|\/)models\.py$|\.model\.(ts|js)$/i
+
+/** Tables whose schema (in this file) declares the tenant column. */
+export function detectTenantTables(rel, content, t) {
+  const found = []
+  const has = (body) => t.declRe.test(body)
+  // SQL: CREATE TABLE x ( … tenant_id … ) and ALTER TABLE x ADD [COLUMN] tenant_id
+  for (const m of content.matchAll(/CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?((?:["`\w]+\.)?["`]?\w+["`]?)\s*\(/gi)) {
+    const open = m.index + m[0].length - 1
+    const close = balanced(content, open, '(', ')')
+    if (has(content.slice(open, close < 0 ? content.length : close))) found.push(m[1])
+  }
+  for (const m of content.matchAll(/ALTER\s+TABLE\s+(?:ONLY\s+)?((?:["`\w]+\.)?["`]?\w+["`]?)\s+ADD\s+(?:COLUMN\s+)?(?:IF\s+NOT\s+EXISTS\s+)?["`]?(\w+)/gi)) {
+    if (t.columns.some((c) => c.toLowerCase() === m[2].toLowerCase())) found.push(m[1])
+  }
+  // Prisma: model X { … tenantId … @@map("x") }
+  for (const m of content.matchAll(/^model\s+(\w+)\s*\{/gm)) {
+    const close = balanced(content, m.index + m[0].length - 1, '{', '}')
+    const body = content.slice(m.index, close < 0 ? content.length : close)
+    if (new RegExp(`^\\s*(?:${t.columns.map(esc).join('|')})\\s`, 'm').test(body)) {
+      found.push(m[1])
+      const map = /@@map\(\s*"(\w+)"/.exec(body)
+      if (map) found.push(map[1])
+    }
+  }
+  // TypeORM: @Entity('x') class X { … tenantId … }
+  for (const m of content.matchAll(/@Entity\s*\(\s*(?:['"`](\w+)['"`]|\{[^}]*name\s*:\s*['"`](\w+)['"`][^}]*\})?[^)]*\)\s*(?:export\s+)?(?:default\s+)?class\s+(\w+)[^{]*\{/g)) {
+    const close = balanced(content, m.index + m[0].length - 1, '{', '}')
+    if (has(content.slice(m.index + m[0].length, close < 0 ? content.length : close))) found.push(...[m[1], m[2], m[3]].filter(Boolean))
+  }
+  // Knex createTable('x', t => { t.string('tenant_id') }) / Alembic op.create_table('x', sa.Column('tenant_id', …))
+  for (const m of content.matchAll(/(?:createTable|create_table)\s*\(\s*['"`](\w+)['"`]/g)) {
+    const open = content.indexOf('(', m.index)
+    const close = balanced(content, open, '(', ')')
+    if (has(content.slice(open, close < 0 ? content.length : close))) found.push(m[1])
+  }
+  // Django / SQLAlchemy model classes: class X(models.Model|Base): … tenant = … / tenant_id = Column(…)
+  if (rel.endsWith('.py')) {
+    for (const m of content.matchAll(/^class\s+(\w+)\s*\(([^)]*)\)\s*:/gm)) {
+      const rest = content.slice(m.index + m[0].length)
+      const end = rest.search(/^\S/m)
+      const body = end < 0 ? rest : rest.slice(0, end)
+      if (new RegExp(`^\\s+(?:${[...t.columns, ...t.columns.map((c) => c.replace(/_id$/i, ''))].map(esc).join('|')})\\s*[:=]`, 'm').test(body)) {
+        found.push(m[1])
+        const tn = /__tablename__\s*=\s*['"](\w+)/.exec(body) || /db_table\s*=\s*['"](\w+)/.exec(body)
+        if (tn) found.push(tn[1])
+      }
+    }
+  }
+  return found.map((n) => n.replace(/["`]/g, '').split('.').pop())
+}
+
+// ── detectors ─────────────────────────────────────────────────────────────
+const SQL_START_RE = /^\s*(SELECT|UPDATE|DELETE|WITH)\b/i
+/** A real statement, not prose that starts with "Update …": SELECT…FROM, UPDATE x SET, DELETE FROM, WITH x AS (. */
+const SQL_SHAPE_RE = /^\s*(?:SELECT\b[\s\S]*\bFROM\b|UPDATE\s+[\w."`]+\s+(?:AS\s+\w+\s+|\w+\s+)?SET\b|DELETE\s+FROM\b|WITH\s+(?:RECURSIVE\s+)?\w+(?:\s*\([^)]*\))?\s+AS\s*\()/i
+
+/** String literals with their offsets; `'a' + 'b'` concatenations and Python implicit concatenation are joined. */
+function stringLiterals(src, py) {
+  const out = []
+  let i = 0
+  const n = src.length
+  const readOne = (at) => {
+    const triple = py && (src.startsWith('"""', at) || src.startsWith("'''", at))
+    const q = triple ? src.slice(at, at + 3) : src[at]
+    let j = at + q.length
+    while (j < n) {
+      if (src[j] === '\\') { j += 2; continue }
+      if (src.startsWith(q, j)) return { text: src.slice(at + q.length, j), end: j + q.length }
+      if (!triple && q !== '`' && src[j] === '\n') return null
+      j++
+    }
+    return null
+  }
+  while (i < n) {
+    const c = src[i]
+    if (!py && c === '/' && src[i + 1] === '/') { i = src.indexOf('\n', i); if (i < 0) break; continue }
+    if (!py && c === '/' && src[i + 1] === '*') { i = src.indexOf('*/', i); if (i < 0) break; i += 2; continue }
+    if (py && c === '#') { i = src.indexOf('\n', i); if (i < 0) break; continue }
+    if (c === '"' || c === "'" || c === '`') {
+      const first = readOne(i)
+      if (!first) { i++; continue }
+      let text = first.text
+      let end = first.end
+      for (;;) {
+        const m = /^\s*\+?\s*(?=["'`])/.exec(src.slice(end))
+        if (!m || (!py && !/\+/.test(m[0]))) break
+        const nx = readOne(end + m[0].length)
+        if (!nx) break
+        text += nx.text; end = nx.end
+      }
+      out.push({ at: i, text, end })
+      i = end
+      continue
+    }
+    i++
+  }
+  return out
+}
+
+function sqlTables(sql) {
+  return [...sql.matchAll(/\b(?:FROM|JOIN|UPDATE|INTO)\s+((?:["`\w]+\.)?["`]?\w+["`]?)/gi)].map((m) => m[1])
+}
+
+function finding(src, idx, rule, what, table, t, why) {
+  const col = t.columns[0]
+  if (rule === 'TENANT_FILTER_UNPROVEN') {
+    return { line: lineOf(src, idx), rule, severity: 'low', message: `${what} on multi-tenant table ${table} ${why || 'builds its filter from a variable/spread'}, so the ${col} filter cannot be seen here. FIX: put ${col} in the literal where-clause, or mark it \`fini-proof: tenant-exempt <reason>\`.` }
+  }
+  return { line: lineOf(src, idx), rule, severity: 'high', message: `${what} on multi-tenant table ${table} has no ${t.columns.join(' / ')} filter — any tenant's request can reach every tenant's rows (cross-tenant data leak / IDOR). FIX: add the tenant condition from the authenticated request context (not from user input), or mark a deliberate cross-tenant path \`fini-proof: tenant-exempt <reason>\`.` }
+}
+
+function rawSql(src, t, py) {
+  const out = []
+  const scan = (text, at) => {
+    const kind = (SQL_START_RE.exec(text) || [])[1]
+    if (!kind || !SQL_SHAPE_RE.test(text)) return
+    const hit = sqlTables(text).find((x) => t.tables.has(tableKey(x)))
+    if (hit && !t.scoped(text)) out.push(finding(src, at, 'TENANT_FILTER_MISSING', `raw SQL ${kind.toUpperCase()}`, hit.replace(/["`]/g, ''), t))
+  }
+  for (const lit of stringLiterals(src, py)) scan(lit.text, lit.at)
+  return out
+}
+
+function sqlFile(src, t) {
+  const out = []
+  const text = src.replace(/--[^\n]*/g, (m) => ' '.repeat(m.length))
+  let at = 0
+  for (const stmt of text.split(';')) {
+    const lead = stmt.length - stmt.trimStart().length
+    const kind = (SQL_START_RE.exec(stmt) || [])[1]
+    if (kind) {
+      const hit = sqlTables(stmt).find((x) => t.tables.has(tableKey(x)))
+      if (hit && !t.scoped(stmt)) out.push(finding(src, at + lead, 'TENANT_FILTER_MISSING', `SQL ${kind.toUpperCase()}`, hit.replace(/["`]/g, ''), t))
+    }
+    at += stmt.length + 1
+  }
+  return out
+}
+
+const ORM_METHODS = 'find|findOne|findOneBy|findBy|findOneOrFail|findAndCount|findMany|findFirst|findFirstOrThrow|findUnique|findUniqueOrThrow|findAll|findByPk|count|countBy|update|updateMany|upsert|delete|deleteMany|destroy|softDelete|aggregate|groupBy|exist|exists'
+const RECEIVER_SUFFIX_RE = /(Repository|Repo|Model|Collection|Table|Dao|DAO|Entity|Store)$/
+const MANAGER_RE = /^(manager|entityManager|em|dataSource|getManager|queryRunner|trx|tx|prisma)$/
+
+function receiverTable(rec, argsHead, t) {
+  let name = rec
+  if (MANAGER_RE.test(rec)) {
+    const first = /^\(\s*([A-Z]\w*)\s*,/.exec(argsHead)
+    if (!first) return null
+    name = first[1]
+  }
+  const k = tableKey(name.replace(RECEIVER_SUFFIX_RE, '') || name)
+  return t.tables.has(k) ? name.replace(RECEIVER_SUFFIX_RE, '') || name : null
+}
+
+/** End of a chained statement in masked JS: `;` or a blank line at paren/brace depth 0. */
+function statementEnd(masked, from) {
+  let depth = 0
+  for (let i = from; i < masked.length; i++) {
+    const c = masked[i]
+    if (c === '(' || c === '{' || c === '[') depth++
+    else if (c === ')' || c === '}' || c === ']') { if (depth === 0) return i; depth-- }
+    else if (depth === 0 && (c === ';' || (c === '\n' && /^\s*\n/.test(masked.slice(i + 1))))) return i
+    else if (depth === 0 && c === '\n' && !/^\s*[.?)]/.test(masked.slice(i + 1)) && !/[.,(=+\-*&|?:]\s*$/.test(masked.slice(Math.max(0, i - 40), i))) return i
+  }
+  return masked.length
+}
+
+const INPUT_OBJ_RE = /^(input|body|params|query|req|request|args|data|payload|dto|ctx|context|event|form|values|options|opts|props)$/
+const SDK_OBJ_RE = /(stripe|s3|sqs|sns|ses|dynamo|octokit|github|slack|twilio|resend|sendgrid|axios|http|fetch|api|sdk|redis|cache|posthog|sentry)$/i
+
+/**
+ * Why a call with no visible tenant condition is still probably checked (→ UNPROVEN), or null (→ MISSING).
+ * src/masked are the file, open/close the call's argument list, table the table key, t the tenant context.
+ */
+function checkedNearby(src, masked, at, close, args, table, t, scopedAt) {
+  const re = /\b(?:id|pk|\w+Id|\w+_id)\s*[:=]\s*([A-Za-z_$][\w$]*)(?:\??\.[\w$]+)*\??\.(?:id|pk|\w*Id|\w*_id)\b/
+  const k = re.exec(args)
+  if (k && !INPUT_OBJ_RE.test(k[1])) return `is re-keyed from the already-loaded ${k[1]} (the tenant check is assumed to be in the lookup that produced it)`
+  const line = lineOf(src, at)
+  if ((scopedAt.get(table) || []).some((l) => l < line && line - l <= 150)) return 'is re-keyed after an earlier tenant-scoped query on the same table in this function'
+  const lhs = /(?:const|let|var)\s+(?:\{[^}]*\}|\[[^\]]*\]|([A-Za-z_$][\w$]*))\s*=\s*(?:await\s+)?[\w$.\s]*$/.exec(masked.slice(Math.max(0, at - 160), at))
+  if (lhs && lhs[1]) {
+    const after = src.slice(close, close + 2500)
+    const colAlt = [...t.columns, ...t.columns.map((c) => c.replace(/_?[iI]d$/, ''))].map(esc).join('|')
+    if (new RegExp(`\\b${esc(lhs[1])}\\??\\.(?:${colAlt})\\b`).test(after)) return `is loaded by id and its ${t.columns[0]} is checked right after the fetch (${lhs[1]}.${t.columns[0]})`
+  }
+  return null
+}
+
+function unproven(args) {
+  return /\.\.\./.test(args) || /\bwhere\s*:\s*[A-Za-z_$][\w$.]*\s*[,}(]/.test(args) || /[{,]\s*where\s*[,}]/.test(args) || /^\(\s*[A-Za-z_$][\w$.]*\s*\)$/.test(args.trim())
+}
+
+function jsOrm(src, t) {
+  const out = []
+  const masked = maskStringsAndComments(src)
+  // 1+2. repository / Prisma / Sequelize / Mongoose-style calls (finipe check 1 & 2, balanced args instead of a window)
+  const re = new RegExp(`([A-Za-z_$][\\w$]*)\\s*\\)?\\s*\\.\\s*(${ORM_METHODS})\\s*\\(`, 'g')
+  const scopedAt = new Map()
+  let m
+  while ((m = re.exec(masked)) !== null) {
+    const open = m.index + m[0].length - 1
+    const close = balanced(masked, open, '(', ')')
+    const args = src.slice(open, close < 0 ? src.length : close + 1)
+    // Array.prototype.find / findIndex(callback) on an in-memory list is not a query
+    if (/^\(\s*(?:async\s+)?(?:function\b|\(?\s*[\w$]*\s*(?:,\s*[\w$]+\s*)*\)?\s*=>)/.test(args)) continue
+    // stripe.subscriptions.update(…) / s3.objects.delete(…): an external SDK, not the database
+    const owner = /([A-Za-z_$][\w$]*)\s*\.\s*$/.exec(masked.slice(Math.max(0, m.index - 60), m.index))
+    if (owner && SDK_OBJ_RE.test(owner[1])) continue
+    const table = receiverTable(m[1], args, t)
+    if (!table) continue
+    if (t.scoped(args)) { const k = tableKey(table); scopedAt.set(k, [...(scopedAt.get(k) || []), lineOf(src, m.index)]); continue }
+    const why = unproven(args) ? 'builds its filter from a variable/spread' : checkedNearby(src, masked, m.index, close, args, tableKey(table), t, scopedAt)
+    out.push(finding(src, m.index, why ? 'TENANT_FILTER_UNPROVEN' : 'TENANT_FILTER_MISSING', `${m[1]}.${m[2]}()`, table, t, why))
+  }
+  // 3. query builders (finipe check 3): the whole chain up to the end of the statement must mention the tenant
+  const qb = /([A-Za-z_$][\w$]*)\s*\)?\s*\.\s*createQueryBuilder\s*\(\s*(?:['"`](\w+)['"`])?/g
+  while ((m = qb.exec(masked)) !== null) {
+    const chain = src.slice(m.index, statementEnd(masked, m.index + m[0].indexOf('createQueryBuilder')))
+    const aliasFrom = /\.\s*from\s*\(\s*([A-Z]\w*|['"`]\w+['"`])/.exec(chain)
+    const table = receiverTable(m[1], '', t) || (aliasFrom && t.tables.has(tableKey(aliasFrom[1])) ? aliasFrom[1].replace(/['"`]/g, '') : null)
+      || (/src|Repository|Repo/.test(m[1]) && m[2] && t.tables.has(tableKey(m[2])) ? m[2] : null)
+    // finipe: a builder with no terminator in view is continued elsewhere — reported as unproven, not missing
+    const ends = /\.\s*(getMany|getOne|getOneOrFail|getRawMany|getRawOne|getCount|getManyAndCount|getExists|execute|stream)\s*\(/.test(chain)
+    if (table && !t.scoped(chain)) out.push(finding(src, m.index, ends ? 'TENANT_FILTER_MISSING' : 'TENANT_FILTER_UNPROVEN', 'query builder', table, t))
+  }
+  // Knex: knex('orders') / db('orders') / trx('orders') … chain
+  const kx = /\b(knex|db|trx|tx|this\.knex|this\.db)\s*\(\s*(['"`])(\w+)\2\s*\)/g
+  for (const k of src.matchAll(kx)) {
+    if (!t.tables.has(tableKey(k[3]))) continue
+    if (/^\s*\.\s*insert\s*\(/.test(src.slice(k.index + k[0].length))) continue
+    const chain = src.slice(k.index, statementEnd(masked, k.index + k[0].length))
+    if (!t.scoped(chain)) out.push(finding(src, k.index, 'TENANT_FILTER_MISSING', `knex('${k[3]}')`, k[3], t))
+  }
+  return out
+}
+
+function pyCheckedNearby(src, code, at, stmt, table, t, scopedAt) {
+  const k = /\b(?:pk|id|\w+_id)\s*=\s*([A-Za-z_]\w*)(?:\.\w+)*\.(?:id|pk|\w+_id)\b/.exec(stmt)
+  if (k && !/^(request|data|payload|params|kwargs|args|serializer|validated_data)$/.test(k[1])) return `is re-keyed from the already-loaded ${k[1]} (the tenant check is assumed to be in the lookup that produced it)`
+  // rows keyed by an already-loaded queryset: CycleIssue.objects.filter(issue__in=issues) / issue_id__in=qs.values_list(…)
+  const inQs = /\b\w+__in\s*=\s*([a-z]\w*)\b/.exec(stmt)
+  if (inQs && !/(^|_)(ids?|pks?)$|^(request|kwargs|data|payload|params|validated_data)$/.test(inQs[1])) return `is keyed by the already-loaded queryset ${inQs[1]}`
+  // DRF field queryset: ownership belongs in the serializer's validate(); fini-proof cannot see that link
+  if (/queryset\s*=\s*$/.test(code.slice(Math.max(0, at - 40), at)) && /^\s*def\s+validate\w*\s*\(/m.test(code)) return 'is a serializer field queryset (ownership is expected in validate(), which this serializer file defines)'
+  // child rows of an already-loaded parent object: IssueLabel.objects.filter(issue=instance)
+  const parent = /\(\s*(?:[^()]*,\s*)?([a-z]\w*)\s*=\s*(instance|obj|self\.instance|self\.object|[a-z]\w*)\s*[,)]/.exec(stmt)
+  if (parent && !/(^|_)(id|pk)$|^(request|kwargs|args|data|payload|params|validated_data)$/.test(parent[2]) && !/(_id|__\w+|_in)$/.test(parent[1]) && parent[1] !== 'pk')
+    return `selects the child rows of the already-loaded ${parent[2]} (${parent[1]}=${parent[2]})`
+  const line = lineOf(src, at)
+  if ((scopedAt.get(table) || []).some((l) => l < line && line - l <= 150)) return 'is re-keyed after an earlier tenant-scoped query on the same table in this function'
+  const lhs = /(?:^|\n)\s*([A-Za-z_]\w*)\s*=\s*$/.exec(code.slice(Math.max(0, at - 120), at))
+  if (lhs) {
+    const colAlt = [...t.columns, ...t.columns.map((c) => c.replace(/_?[iI]d$/, ''))].map(esc).join('|')
+    if (new RegExp(`\\b${esc(lhs[1])}\\.(?:${colAlt})\\b`).test(code.slice(at + stmt.length, at + stmt.length + 2500))) return `is loaded by id and its ${t.columns[0]} is checked right after the fetch`
+  }
+  return null
+}
+
+function pyOrm(src, t) {
+  const out = []
+  const pyScopedAt = new Map()
+  const code = src.replace(/#[^\n]*/g, (x) => ' '.repeat(x.length))
+  const logicalEnd = (from) => {
+    let depth = 0
+    for (let i = from; i < code.length; i++) {
+      const c = code[i]
+      if (c === '(' || c === '[' || c === '{') depth++
+      else if (c === ')' || c === ']' || c === '}') depth--
+      else if (c === '\n' && depth <= 0 && code[i - 1] !== '\\' && !/^\s*\./.test(code.slice(i + 1, i + 200))) return i
+    }
+    return code.length
+  }
+  // Django: Model.objects.<all|filter|get|exclude|update|delete|values…>(
+  for (const m of code.matchAll(/\b([A-Z]\w*)\.objects\.(all|filter|get|exclude|update|delete|values|values_list|first|last|count|iterator|select_related|prefetch_related|order_by|get_or_create|update_or_create)\s*\(/g)) {
+    if (!t.tables.has(tableKey(m[1]))) continue
+    const stmt = code.slice(m.index, logicalEnd(m.index))
+    if (/\bOuterRef\s*\(/.test(stmt)) continue // correlated sub-query: scoped by the outer query
+    if (/\bPrefetch\s*\([^()]*$/.test(code.slice(Math.max(0, m.index - 120), m.index))) continue // Prefetch(queryset=…): scoped by the outer queryset
+    if (t.scoped(stmt)) { const k = tableKey(m[1]); pyScopedAt.set(k, [...(pyScopedAt.get(k) || []), lineOf(src, m.index)]); continue }
+    const why = /\*\*\w/.test(stmt) ? 'builds its filter from a variable/spread' : pyCheckedNearby(src, code, m.index, stmt, tableKey(m[1]), t, pyScopedAt)
+    out.push(finding(src, m.index, why ? 'TENANT_FILTER_UNPROVEN' : 'TENANT_FILTER_MISSING', `${m[1]}.objects.${m[2]}()`, m[1], t, why))
+  }
+  // SQLAlchemy: session.query(Model)… / select(Model)… / update(Model) / delete(Model)
+  for (const m of code.matchAll(/\b(query|select|update|delete)\s*\(\s*([A-Z]\w*)\b/g)) {
+    if (!t.tables.has(tableKey(m[2]))) continue
+    const stmt = code.slice(m.index, logicalEnd(m.index))
+    if (!t.scoped(stmt)) out.push(finding(src, m.index, 'TENANT_FILTER_MISSING', `${m[1]}(${m[2]})`, m[2], t))
+  }
+  return out
+}
+
+function exempted(src, line) {
+  const lines = src.split('\n')
+  return /fini-proof:\s*tenant-exempt\s+\S{3,}/.test(lines.slice(Math.max(0, line - 3), line).join('\n'))
+}
+
+const CTL = tenantContext({ column: 'tenant_id', tables: ['orders', 'invoices'] })
+
+export default {
+  id: 'tenant-filter',
+  version: '0.3.0',
+  title: 'Tenant filter missing on multi-tenant queries',
+  provenance: 'finipe .github/scripts/check-tenant-scoping.js detector shapes @ 4ac53b367 (last changed 990d528dd); windows → balanced extents, schema-aware table set new',
+  optionalScope: true,
+  notApplicableReason: 'no source file in scope',
+  appliesTo: (rel) => CODE_RE.test(rel) && !TEST_RE.test(rel) && !MIGRATION_PATH_RE.test(rel),
+  /** Whole-repo pass (runs even in --base mode): which tables are multi-tenant. */
+  prepare({ config = {}, files = [], read }) {
+    const cfg = config.tenant || {}
+    const explicit = Boolean(config.tenant)
+    const base = tenantContext(cfg)
+    const detected = new Set()
+    const rls = new Set()
+    const unreadable = []
+    let tablesSource = 'schema'
+    if (!cfg.tables || cfg.detect !== false) {
+      const fromDecl = new Set()
+      const fromMig = new Set()
+      const pyClasses = []
+      for (const rel of files.filter((f) => SCHEMA_RE.test(f) && !TEST_RE.test(f)).sort()) {
+        const r = read(rel)
+        if (r.error) { unreadable.push(rel); continue }
+        const decl = DECLARATIVE_RE.test(rel) && !MIGRATION_PATH_RE.test(rel)
+        for (const n of detectTenantTables(rel, r.content, base)) (decl ? fromDecl : fromMig).add(n)
+        for (const n of detectRlsTables(r.content)) rls.add(n)
+        if (decl && rel.endsWith('.py')) pyClasses.push(...pyModelClasses(r.content))
+      }
+      // inheritance: a model whose base class carries the tenant column carries it too (transitively)
+      for (let grew = true; grew;) {
+        grew = false
+        for (const c of pyClasses) {
+          if (!fromDecl.has(c.name) && c.bases.some((b) => fromDecl.has(b))) {
+            fromDecl.add(c.name)
+            if (c.table) fromDecl.add(c.table)
+            grew = true
+          }
+        }
+      }
+      // the declarative schema is the CURRENT truth; migrations are history (a column may have been dropped since)
+      const src = fromDecl.size ? fromDecl : fromMig
+      tablesSource = fromDecl.size ? 'schema:models' : 'schema:migrations'
+      for (const n of src) detected.add(n)
+    }
+    if (unreadable.length) return { unmeasured: `schema file(s) could not be read, so the multi-tenant table set is unknown: ${unreadable.slice(0, 5).join(', ')}` }
+    const rlsTables = [...rls].filter((n) => !(cfg.tables || []).some((x) => tableKey(x) === tableKey(n)))
+    const t = tenantContext({ ...cfg, tables: [...new Set([...(cfg.tables || []), ...detected])], exemptTables: [...(cfg.exemptTables || []), ...rlsTables] })
+    const measurements = {
+      tenantColumns: t.columns, tenantTables: [...new Set(t.tableNames)].sort(), tablesFrom: cfg.tables ? (detected.size ? `config+${tablesSource}` : 'config') : tablesSource,
+      ...(rlsTables.length ? { rlsTables: rlsTables.sort() } : {}),
+      ...(cfg.helpers?.length ? { scopeHelpers: cfg.helpers } : {}),
+      ...(cfg.scopeColumns?.length ? { scopeColumns: cfg.scopeColumns } : {}),
+    }
+    if (!t.tables.size) {
+      const why = `no multi-tenant table found (no schema declares ${t.columns.join(' / ')}; set "tenant": { "column": …, "tables": [...] } in .fini-proof.json)`
+      return explicit ? { unmeasured: `tenant config is set but ${why}`, measurements } : { notApplicable: why, measurements }
+    }
+    return { ctx: { tenant: t }, measurements }
+  },
+  scanFile(rel, content, ctx = {}) {
+    const t = ctx.tenant
+    if (!t || t.exemptPathRes.some((re) => re.test(rel))) return []
+    let found
+    if (rel.endsWith('.sql')) found = sqlFile(content, t)
+    else if (rel.endsWith('.py')) found = [...rawSql(content, t, true), ...pyOrm(content, t)]
+    else if (JS_RE.test(rel)) found = [...rawSql(content, t, false), ...jsOrm(content, t)]
+    else found = rawSql(content, t, false)
+    const seen = new Set()
+    return found
+      .filter((f) => { const k = `${f.line}:${f.rule}`; if (seen.has(k)) return false; seen.add(k); return true })
+      .filter((f) => !exempted(content, f.line))
+      .sort((a, b) => a.line - b.line)
+  },
+  rules: {
+    TENANT_FILTER_MISSING: { severity: 'high', summary: 'a query on a multi-tenant table has no tenant condition — one tenant can read or change another tenant\'s rows', fix: 'add the tenant condition from the authenticated context, or mark a deliberate cross-tenant path `fini-proof: tenant-exempt <reason>`' },
+    TENANT_FILTER_UNPROVEN: { severity: 'low', summary: 'the query\'s filter comes from a variable or spread, so the tenant condition cannot be seen at the call site', fix: 'write the tenant condition into the literal where-clause' },
+  },
+  negativeControls: [
+    { id: 'tenant-filter/NC-1', file: 'src/reports.js', expect: 'TENANT_FILTER_MISSING', ctx: { tenant: CTL }, content: "export async function orderById(db, id) {\n  return db.query('SELECT * FROM orders WHERE id = $1', [id])\n}\n" },
+    { id: 'tenant-filter/NC-2', file: 'src/orders/order.service.ts', expect: 'TENANT_FILTER_MISSING', ctx: { tenant: CTL }, content: "export class OrderService {\n  get(id: string) {\n    return this.orderRepository.findOne({ where: { id } })\n  }\n}\n" },
+    { id: 'tenant-filter/NC-3', file: 'src/invoices.ts', expect: 'TENANT_FILTER_MISSING', ctx: { tenant: CTL }, content: "export const due = () => prisma.invoice.findMany({\n  where: { status: 'DUE' },\n})\n" },
+    { id: 'tenant-filter/NC-4', file: 'app/views.py', expect: 'TENANT_FILTER_MISSING', ctx: { tenant: CTL }, content: "def open_orders(request):\n    return Order.objects.filter(status='open')\n" },
+    { id: 'tenant-filter/NC-6', file: 'src/billing.ts', expect: 'TENANT_FILTER_MISSING', ctx: { tenant: tenantContext({ column: 'tenant_id', tables: ['invoices'], helpers: ['tenantWhere'] }) }, content: "// a declared helper counts only where it is called\nexport const due = () => prisma.invoice.findMany({ where: { status: 'DUE' } })\n" },
+    { id: 'tenant-filter/NC-7', file: 'src/docs/send.ts', expect: 'TENANT_FILTER_MISSING', ctx: { tenant: CTL }, content: "// an id taken from the request is NOT a re-key: still a leak\nexport const send = (input) => prisma.invoice.update({ where: { id: input.id }, data: { sent: true } })\n" },
+    { id: 'tenant-filter/NC-8', file: 'src/docs/resend.ts', expect: 'TENANT_FILTER_UNPROVEN', ctx: { tenant: CTL }, content: "export async function resend(ctx, id) {\n  const inv = await prisma.invoice.findFirst({ where: { id, tenantId: ctx.tenantId } })\n  return prisma.invoice.update({ where: { id: inv.id }, data: { sent: true } })\n}\n" },
+    { id: 'tenant-filter/NC-9', file: 'app/serializers.py', expect: 'TENANT_FILTER_MISSING', ctx: { tenant: CTL }, content: "class InvoiceSerializer(serializers.Serializer):\n    # no validate(): any tenant's invoice id is accepted\n    invoice_id = serializers.PrimaryKeyRelatedField(queryset=Invoice.objects.all())\n" },
+    { id: 'tenant-filter/NC-5', file: 'src/admin.js', expect: 'TENANT_FILTER_MISSING', ctx: { tenant: CTL }, content: "export const cancel = (id) =>\n  knex('orders').where({ id }).update({ status: 'cancelled' })\n" },
+  ],
+  positiveControls: [
+    { id: 'tenant-filter/PC-1', rule: 'TENANT_FILTER_MISSING', file: 'src/reports.js', ctx: { tenant: CTL }, content: "export const orderById = (db, tenantId, id) =>\n  db.query('SELECT * FROM orders WHERE tenant_id = $1 AND id = $2', [tenantId, id])\nexport const countries = (db) => db.query('SELECT * FROM countries')\nexport const one = (id, tenantId) => this.orderRepository.findOne({ where: { id, tenantId } })\n" },
+    { id: 'tenant-filter/PC-2', file: 'app/views.py', ctx: { tenant: CTL }, content: "def open_orders(request):\n    return Order.objects.filter(tenant=request.tenant, status='open')\n" },
+    { id: 'tenant-filter/PC-4', file: 'src/ui/list.ts', ctx: { tenant: tenantContext({ column: 'tenant_id', tables: ['orders', 'invoices'], helpers: ['tenantWhere'], scopeColumns: ['project_id'] }) }, content: "const next = orders.find((o) => o.status !== 'DONE')\nexport const due = (ctx) => prisma.invoice.findMany({ where: tenantWhere(ctx, { status: 'DUE' }) })\nexport const byProject = (projectId) => prisma.order.findMany({ where: { project_id: projectId } })\nexport const doc = { summary: 'Update orders for a template', description: 'Select invoices from the list' }\n" },
+    { id: 'tenant-filter/PC-7', file: 'src/invites.ts', ctx: { tenant: tenantContext({ column: 'tenant_id', tables: ['invites'], scopeColumns: ['token'] }) }, content: "export const byToken = (token) => prisma.invite.findFirst({ where: { token, }, })\n" },
+    { id: 'tenant-filter/PC-8', file: 'app/views.py', ctx: { tenant: tenantContext({ column: 'workspace_id', tables: ['projects', 'modules', 'assets'], scopeColumns: ['project_id', 'user'] }) }, content: "def get(request, project_id, asset_id):\n    project = Project.objects.get(pk=project_id)\n    asset = Asset.objects.get(id=asset_id, user_id=request.user.id)\n    return Module.objects.prefetch_related(Prefetch('links', queryset=Module.objects.all())).filter(project_id=project_id)\n" },
+    { id: 'tenant-filter/PC-9', file: 'app/views/activity.py', ctx: { tenant: tenantContext({ column: 'workspace_id', tables: ['issue_activities', 'projects', 'issues'], scopeColumns: ['member', 'project_id'] }) }, content: "def get(self, request, issue_id):\n    project = Project.objects.get(id=self.kwargs.get(\"project_id\"))\n    return (\n        IssueActivity.objects.filter(issue_id=issue_id)\n        .filter(project__project_projectmember__member=self.request.user)\n    )\n" },
+    { id: 'tenant-filter/PC-6', file: 'src/billing/stripe.ts', ctx: { tenant: CTL }, content: "export const bump = (id, items) => stripe.invoices.update(id, { items })\n" },
+    { id: 'tenant-filter/PC-5', file: 'app/views.py', ctx: { tenant: CTL }, content: "def annotated(qs):\n    return qs.annotate(n=Subquery(Order.objects.filter(customer_id=OuterRef('id')).values('id')[:1]))\n" },
+    { id: 'tenant-filter/PC-10', rule: 'TENANT_FILTER_UNPROVEN', file: 'src/docs/resend.ts', ctx: { tenant: CTL }, content: "export async function resend(ctx, id) {\n  const inv = await prisma.invoice.findFirst({ where: { id, tenantId: ctx.tenantId } })\n  return prisma.invoice.update({ where: { id: inv.id, tenantId: ctx.tenantId }, data: { sent: true } })\n}\n" },
+    { id: 'tenant-filter/PC-3', file: 'src/platform/stats.ts', ctx: { tenant: CTL }, content: "// fini-proof: tenant-exempt platform-admin revenue report, reads all tenants by design (SEC-19)\nexport const total = () => prisma.invoice.findMany({ select: { amount: true } })\n" },
+  ],
+}