oauthlint 0.1.0

package/dist/core/suppress.js

@@ -0,0 +1,81 @@
+import { readFile } from 'node:fs/promises';
+const DIRECTIVE_RE = /oauthlint-disable-(next-line|line|file)\s+([a-z0-9.*-]+)(?:\s*--\s*(.+))?/i;
+export async function loadSuppressionMap(filePath) {
+    let text;
+    try {
+        text = await readFile(filePath, 'utf8');
+    }
+    catch {
+        return { byLine: new Map(), fileWide: new Set() };
+    }
+    return parseSuppressionsFromSource(text);
+}
+export function parseSuppressionsFromSource(source) {
+    const byLine = new Map();
+    const fileWide = new Set();
+    const lines = source.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const match = lines[i]?.match(DIRECTIVE_RE);
+        if (!match)
+            continue;
+        const kind = match[1]?.toLowerCase();
+        const ruleId = match[2]?.toLowerCase();
+        if (!kind || !ruleId)
+            continue;
+        if (kind === 'file') {
+            if (ruleId === '*') {
+                // We deliberately don't let `disable-file *` work — see comment above.
+                continue;
+            }
+            fileWide.add(ruleId);
+            continue;
+        }
+        // disable-line: same line; disable-next-line: i + 1
+        const target = kind === 'line' ? i : i + 1;
+        let set = byLine.get(ruleId);
+        if (!set) {
+            set = new Set();
+            byLine.set(ruleId, set);
+        }
+        set.add(target);
+    }
+    return { byLine, fileWide };
+}
+export function isSuppressed(finding, maps) {
+    if (maps.fileWide.has(finding.ruleId) || maps.fileWide.has('*')) {
+        return true;
+    }
+    // Semgrep returns 1-based start lines; our suppression map is 0-based
+    // because we walk the source array with for-loops.
+    const lineIdx = finding.startLine - 1;
+    for (const id of [finding.ruleId, '*']) {
+        const lines = maps.byLine.get(id);
+        if (lines?.has(lineIdx))
+            return true;
+    }
+    return false;
+}
+/**
+ * Apply suppression to a list of findings. Caches the parsed directive
+ * map per-file so we only read each file once.
+ */
+export async function applySuppressions(findings) {
+    const cache = new Map();
+    const kept = [];
+    const suppressed = [];
+    for (const f of findings) {
+        let maps = cache.get(f.filePath);
+        if (!maps) {
+            maps = await loadSuppressionMap(f.filePath);
+            cache.set(f.filePath, maps);
+        }
+        if (isSuppressed(f, maps)) {
+            suppressed.push(f);
+        }
+        else {
+            kept.push(f);
+        }
+    }
+    return { kept, suppressed };
+}
+//# sourceMappingURL=suppress.js.map

package/dist/core/suppress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"suppress.js","sourceRoot":"","sources":["../../src/core/suppress.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AA+B5C,MAAM,YAAY,GAAG,4EAA4E,CAAC;AAElG,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAgB;IACvD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,2BAA2B,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAc;IACxD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAEjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,SAAS;QAE/B,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnB,uEAAuE;gBACvE,SAAS;YACX,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QAED,oDAAoD;QACpD,MAAM,MAAM,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;YAChB,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAgB,EAAE,IAAqB;IAClE,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,sEAAsE;IACtE,mDAAmD;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;IACtC,KAAK,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAmB;IAIzD,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IACjD,MAAM,IAAI,GAAc,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAc,EAAE,CAAC;IAEjC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,MAAM,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC5C,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;YAC1B,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9B,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,13 @@
+export { buildProgram } from './cli.js';
+export { runScan, type ScanCommandOptions } from './commands/scan.js';
+export { runList, type ListOptions } from './commands/list.js';
+export { runInit, type InitOptions } from './commands/init.js';
+export { runDoctor, type DoctorOptions } from './commands/doctor.js';
+export { applySuppressions, isSuppressed, loadSuppressionMap, parseSuppressionsFromSource, } from './core/suppress.js';
+export { SemgrepAdapter, SemgrepNotInstalledError } from './adapters/semgrep.js';
+export { Reporter, type ReporterOptions } from './core/reporter.js';
+export { loadConfig, DEFAULT_CONFIG } from './core/config.js';
+export { exitCodeFor, highestSeverity, meetsThreshold, severityRank, } from './core/severity.js';
+export type { OAuthLintConfig, Finding, ScanResult, SeverityName, } from './types.js';
+export { SEVERITIES } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAE,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EACL,WAAW,EACX,eAAe,EACf,cAAc,EACd,YAAY,GACb,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,eAAe,EACf,OAAO,EACP,UAAU,EACV,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,12 @@
+export { buildProgram } from './cli.js';
+export { runScan } from './commands/scan.js';
+export { runList } from './commands/list.js';
+export { runInit } from './commands/init.js';
+export { runDoctor } from './commands/doctor.js';
+export { applySuppressions, isSuppressed, loadSuppressionMap, parseSuppressionsFromSource, } from './core/suppress.js';
+export { SemgrepAdapter, SemgrepNotInstalledError } from './adapters/semgrep.js';
+export { Reporter } from './core/reporter.js';
+export { loadConfig, DEFAULT_CONFIG } from './core/config.js';
+export { exitCodeFor, highestSeverity, meetsThreshold, severityRank, } from './core/severity.js';
+export { SEVERITIES } from './types.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,OAAO,EAA2B,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAoB,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAoB,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAsB,MAAM,sBAAsB,CAAC;AACrE,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAwB,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EACL,WAAW,EACX,eAAe,EACf,cAAc,EACd,YAAY,GACb,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Severity used both for filtering and for exit-code decisions.
+ * Order matters: items later in the array are considered "worse".
+ */
+export declare const SEVERITIES: readonly ["INFO", "LOW", "MEDIUM", "HIGH", "CRITICAL"];
+export type SeverityName = (typeof SEVERITIES)[number];
+/**
+ * Map raw Semgrep severities to our 5-level scale.
+ * Semgrep itself only emits INFO / WARNING / ERROR, but each rule can
+ * additionally declare its own severity metadata; we honour rule metadata
+ * when present.
+ */
+export declare const SEMGREP_SEVERITY_MAP: Record<string, SeverityName>;
+export interface Finding {
+    /** Rule id, e.g. "auth.jwt.alg-none" */
+    ruleId: string;
+    /** OAuthLint-specific id, e.g. "AUTH-JWT-001" */
+    oauthlintRuleId?: string;
+    severity: SeverityName;
+    filePath: string;
+    startLine: number;
+    endLine: number;
+    message: string;
+    docUrl?: string;
+    cwe?: string;
+    llmPrevalence?: 'HIGH' | 'MEDIUM' | 'LOW';
+}
+export interface ScanResult {
+    findings: Finding[];
+    scannedFiles: number;
+    durationMs: number;
+    semgrepVersion: string | null;
+    errors: string[];
+}
+export interface OAuthLintConfig {
+    include?: string[];
+    exclude?: string[];
+    rules?: Record<string, 'off' | 'warn' | SeverityName>;
+    customRulesDir?: string;
+    failOn?: SeverityName | 'off';
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,eAAO,MAAM,UAAU,wDAAyD,CAAC;AACjF,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAI7D,CAAC;AAEF,MAAM,WAAW,OAAO;IACtB,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;CAC3C;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,YAAY,CAAC,CAAC;IACtD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,YAAY,GAAG,KAAK,CAAC;CAC/B"}

package/dist/types.js

@@ -0,0 +1,17 @@
+/**
+ * Severity used both for filtering and for exit-code decisions.
+ * Order matters: items later in the array are considered "worse".
+ */
+export const SEVERITIES = ['INFO', 'LOW', 'MEDIUM', 'HIGH', 'CRITICAL'];
+/**
+ * Map raw Semgrep severities to our 5-level scale.
+ * Semgrep itself only emits INFO / WARNING / ERROR, but each rule can
+ * additionally declare its own severity metadata; we honour rule metadata
+ * when present.
+ */
+export const SEMGREP_SEVERITY_MAP = {
+    INFO: 'INFO',
+    WARNING: 'MEDIUM',
+    ERROR: 'HIGH',
+};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;AAGjF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAiC;IAChE,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,QAAQ;IACjB,KAAK,EAAE,MAAM;CACd,CAAC"}

package/package.json

@@ -0,0 +1,71 @@
+{
+  "name": "oauthlint",
+  "version": "0.1.0",
+  "description": "Catch the OAuth/OIDC/JWT anti-patterns AI coding tools systematically produce. CLI wrapper around the oauthlint-rules Semgrep rule pack.",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "oauthlint": "./bin/oauthlint.js"
+  },
+  "files": [
+    "dist",
+    "bin",
+    "README.md",
+    "LICENSE"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "keywords": [
+    "oauthlint",
+    "semgrep",
+    "oauth",
+    "oidc",
+    "jwt",
+    "security",
+    "sast",
+    "cli",
+    "ai-code",
+    "vibe-coding"
+  ],
+  "dependencies": {
+    "commander": "12.1.0",
+    "cosmiconfig": "9.0.0",
+    "execa": "9.6.0",
+    "picocolors": "1.1.1",
+    "yaml": "2.6.1",
+    "zod": "3.24.1",
+    "oauthlint-rules": "0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "22.10.5",
+    "typescript": "5.7.3",
+    "vitest": "2.1.9"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Auspeo/oauthlint.git",
+    "directory": "cli"
+  },
+  "homepage": "https://oauthlint.dev",
+  "bugs": "https://github.com/Auspeo/oauthlint/issues",
+  "license": "MIT",
+  "author": "Maurice Anney <webofboss@gmail.com>",
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest",
+    "test:run": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "start": "node bin/oauthlint.js"
+  }
+}