oc-pilot 0.5.1 → 0.88.1

package/dist/core/arch-diff.test.js

@@ -0,0 +1,93 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import { analyzeArchDiff, describeArchDiff, renderMermaid } from "./arch-diff.js";
+function makeRepo() {
+    const dir = mkdtempSync(join(tmpdir(), "oc-pilot-arch-"));
+    spawnSync("git", ["init", "-q"], { cwd: dir });
+    mkdirSync(join(dir, "src"), { recursive: true });
+    writeFileSync(join(dir, "src", "a.ts"), 'import { c } from "./c";\n\nexport const a = c;\n', "utf8");
+    writeFileSync(join(dir, "src", "b.ts"), "export const b = 1;\n", "utf8");
+    writeFileSync(join(dir, "src", "c.ts"), "export const c = 1;\n", "utf8");
+    return dir;
+}
+const DIFF = [
+    "diff --git a/src/a.ts b/src/a.ts",
+    "--- a/src/a.ts",
+    "+++ b/src/a.ts",
+    "@@ -1,3 +1,3 @@",
+    '-import { c } from "./c";',
+    '+import { b } from "./b";',
+    " ",
+    " export const a = c;",
+    "",
+].join("\n");
+test("analyzeArchDiff reports added and removed internal imports", () => {
+    const dir = makeRepo();
+    try {
+        const report = analyzeArchDiff(dir, DIFF);
+        assert.equal(report.added.length, 1);
+        assert.equal(report.removed.length, 1);
+        assert.equal(report.added[0]?.from, "src/a.ts");
+        assert.equal(report.added[0]?.to, "src/b.ts");
+        assert.equal(report.removed[0]?.to, "src/c.ts");
+        assert.deepEqual(report.nodes, ["src/a.ts", "src/b.ts", "src/c.ts"]);
+        assert.match(report.diagram, /flowchart LR/);
+        assert.match(report.diagram, /-->\\|added\\|/);
+        assert.match(report.diagram, /-\\.->\\|removed\\|/);
+        assert.match(report.diagram, /classDef added/);
+        assert.match(report.diagram, /classDef removed/);
+        assert.match(renderMermaid(report), /^```mermaid/);
+        assert.match(describeArchDiff(report), /1/);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+test("analyzeArchDiff ignores package imports", () => {
+    const dir = makeRepo();
+    try {
+        const diff = [
+            "diff --git a/src/a.ts b/src/a.ts",
+            "--- a/src/a.ts",
+            "+++ b/src/a.ts",
+            "@@ -1,1 +1,2 @@",
+            '+import { readFileSync } from "node:fs";',
+            " export const a = 1;",
+            "",
+        ].join("\n");
+        const report = analyzeArchDiff(dir, diff);
+        assert.deepEqual(report.added, []);
+        assert.deepEqual(report.removed, []);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+test("analyzeArchDiff caps the number of edges", () => {
+    const dir = makeRepo();
+    try {
+        writeFileSync(join(dir, "src", "d.ts"), "export const d = 1;\n", "utf8");
+        writeFileSync(join(dir, "src", "e.ts"), "export const e = 1;\n", "utf8");
+        const diff = [
+            "diff --git a/src/a.ts b/src/a.ts",
+            "--- a/src/a.ts",
+            "+++ b/src/a.ts",
+            "@@ -1,1 +1,3 @@",
+            '+import { b } from "./b";',
+            '+import { d } from "./d";',
+            '+import { e } from "./e";',
+            "",
+        ].join("\n");
+        const report = analyzeArchDiff(dir, diff, { maxEdges: 1 });
+        assert.equal(report.added.length, 1);
+        assert.equal(report.truncated, true);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+//# sourceMappingURL=arch-diff.test.js.map

package/dist/core/arch-diff.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arch-diff.test.js","sourceRoot":"","sources":["../../src/core/arch-diff.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAElF,SAAS,QAAQ;IACf,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC1D,SAAS,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/C,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,mDAAmD,EAAE,MAAM,CAAC,CAAC;IACrG,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACzE,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACzE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,IAAI,GAAG;IACX,kCAAkC;IAClC,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,2BAA2B;IAC3B,2BAA2B;IAC3B,GAAG;IACH,sBAAsB;IACtB,EAAE;CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,IAAI,CAAC,4DAA4D,EAAE,GAAG,EAAE;IACtE,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;QAChD,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;QACrE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yCAAyC,EAAE,GAAG,EAAE;IACnD,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG;YACX,kCAAkC;YAClC,gBAAgB;YAChB,gBAAgB;YAChB,iBAAiB;YACjB,0CAA0C;YAC1C,sBAAsB;YACtB,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1C,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACpD,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,uBAAuB,EAAE,MAAM,CAAC,CAAC;QACzE,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,uBAAuB,EAAE,MAAM,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG;YACX,kCAAkC;YAClC,gBAAgB;YAChB,gBAAgB;YAChB,iBAAiB;YACjB,2BAA2B;YAC3B,2BAA2B;YAC3B,2BAA2B;YAC3B,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/core/authz.js

@@ -0,0 +1,292 @@
+import { VERSION } from "../version.js";
+import { SARIF_SCHEMA, SARIF_VERSION } from "./sarif.js";
+import { stripComments } from "./sast.js";
+const ROUTE_CALL = /\b(?:app|router|server|fastify|api)\.(get|post|put|patch|delete|all|use)\s*\(\s*["'`]([^"'`]+)["'`]/g;
+const NEXT_METHOD = /export\s+(?:async\s+)?function\s+(GET|POST|PUT|PATCH|DELETE)\s*\(|export\s+const\s+(GET|POST|PUT|PATCH|DELETE)\s*=/g;
+const AUTH = /\b(?:req|request|ctx)\.(?:user|session|auth)\b|\bres\.locals\.user\b|\b(?:getServerSession|getSession|currentUser|requireAuth|requireUser|ensureAuth|ensureLoggedIn|isAuthenticated|isLoggedIn|authMiddleware|authorize|checkPermission|verifyToken|verifyIdToken|verifyJwt|jwt\.verify|passport\.authenticate)\b|\bauth\s*\(/;
+const REQUEST_ID = /\b(?:req|request)\.(?:params|body|query)\.(?:id|userId|accountId|orderId)\b/;
+const LOOKUP = /\b(?:findById|findOne|findUnique|findFirst|getById|fetchById)\s*\(|\.where\s*\(\s*\{\s*id\b|\bWHERE\s+id\s*=/i;
+const OWNERSHIP = /\b(?:req|request)\.user\.(?:id|sub)\b|\b(?:ownerId|tenantId|accountId|orgId|workspaceId|teamId)\b|\b(?:userId|createdBy|authorId)\s*===?\s*(?:req|request)\.user/;
+const ROLE = /\b(?:role|roles|isAdmin|requireAdmin|checkPermission|permission|permissions|scope|scopes)\b/;
+const ADMIN_PATH = /(?:^|\/)(?:admin|internal|manage|management)(?:\/|$)/i;
+const DEFAULT_PUBLIC = /^\/(?:health|healthz|ready|live|metrics|ping|login|logout|signup|register|public|webhooks?|oauth|auth\/callback|favicon\.ico)(?:\/|$)/i;
+const SUPPRESSION = /oc-pilot:authz-ignore(?:\s+([\w-]+))?\s*:\s*(\S.*)$/;
+const SEVERITY_RANK = { medium: 1, high: 2 };
+const RULE_RANK = { "route-no-auth": 0, idor: 1, "admin-no-guard": 2 };
+export function severityAtLeast(value, threshold) {
+    return SEVERITY_RANK[value] >= SEVERITY_RANK[threshold];
+}
+export function parseAuthzSeverity(value) {
+    return value === "high" || value === "medium" ? value : undefined;
+}
+function lineStarts(text) {
+    const starts = [0];
+    for (let index = 0; index < text.length; index += 1) {
+        if (text[index] === "\n")
+            starts.push(index + 1);
+    }
+    return starts;
+}
+function locate(starts, offset) {
+    let low = 0;
+    let high = starts.length - 1;
+    while (low < high) {
+        const middle = Math.ceil((low + high) / 2);
+        if (starts[middle] <= offset)
+            low = middle;
+        else
+            high = middle - 1;
+    }
+    return { line: low + 1, column: offset - starts[low] + 1 };
+}
+function suppressionAt(lines, lineIndex, rule) {
+    for (const index of [lineIndex, lineIndex - 1]) {
+        const line = lines[index];
+        if (!line)
+            continue;
+        const match = line.match(SUPPRESSION);
+        if (!match)
+            continue;
+        const scopedRule = match[1];
+        const reason = match[2]?.trim() ?? "";
+        if (reason.length < 3)
+            continue;
+        if (scopedRule && scopedRule !== rule)
+            continue;
+        return true;
+    }
+    return false;
+}
+function isPublic(route, options) {
+    if (DEFAULT_PUBLIC.test(route))
+        return true;
+    return (options.publicRoutes ?? []).some((prefix) => prefix.length > 0 && route.startsWith(prefix));
+}
+function routeFromAppPath(file) {
+    const index = file.indexOf("app/");
+    const rest = file
+        .slice(index + 4)
+        .replace(/\/?route\.(?:ts|js|tsx|jsx)$/, "");
+    const segments = rest
+        .split("/")
+        .filter(Boolean)
+        .filter((segment) => !/^\(.*\)$/.test(segment))
+        .map((segment) => {
+        if (segment.startsWith("[..."))
+            return "*";
+        if (segment.startsWith("["))
+            return `:${segment.replace(/^\[|\]$/g, "")}`;
+        return segment;
+    });
+    return `/${segments.join("/")}`;
+}
+function routeFromPagesPath(file) {
+    const index = file.indexOf("pages/api/");
+    let rest = file.slice(index + "pages/api/".length).replace(/\.(?:ts|js|tsx|jsx)$/, "");
+    rest = rest.replace(/\/index$/, "").replace(/^index$/, "");
+    const segments = rest
+        .split("/")
+        .filter(Boolean)
+        .map((segment) => {
+        if (segment.startsWith("[..."))
+            return "*";
+        if (segment.startsWith("["))
+            return `:${segment.replace(/^\[|\]$/g, "")}`;
+        return segment;
+    });
+    return `/api${segments.length > 0 ? `/${segments.join("/")}` : ""}`;
+}
+/**
+ * Finds route declarations and checks their handler scope for authentication,
+ * ownership and role signals. This is an offline heuristic, not a data-flow
+ * analysis: it is deliberately quiet when a handler is a bare reference.
+ */
+export function scanAuthzSource(file, text, options = {}) {
+    const clean = stripComments(text);
+    const starts = lineStarts(clean);
+    const lines = text.split(/\r?\n/);
+    const normalized = file.replace(/\\/g, "/");
+    const raw = [];
+    const isApp = /(?:^|\/)app\/.*route\.(?:ts|js|tsx|jsx)$/.test(normalized);
+    const isPages = /(?:^|\/)pages\/api\/.*\.(?:ts|js|tsx|jsx)$/.test(normalized);
+    if (isApp || isPages) {
+        const route = isApp ? routeFromAppPath(normalized) : routeFromPagesPath(normalized);
+        const methods = [...clean.matchAll(NEXT_METHOD)];
+        for (let index = 0; index < methods.length; index += 1) {
+            const match = methods[index];
+            const method = match[1] ?? match[2] ?? "GET";
+            const offset = match.index ?? 0;
+            const { line, column } = locate(starts, offset);
+            raw.push({
+                method,
+                route,
+                line,
+                column,
+                bodyStart: offset,
+                end: methods[index + 1]?.index ?? clean.length,
+            });
+        }
+        if (methods.length === 0 && /export\s+default\b/.test(clean)) {
+            const { line, column } = locate(starts, 0);
+            raw.push({ method: "*", route, line, column, bodyStart: 0, end: clean.length });
+        }
+    }
+    else {
+        const matches = [...clean.matchAll(ROUTE_CALL)];
+        for (let index = 0; index < matches.length; index += 1) {
+            const match = matches[index];
+            const method = (match[1] ?? "get").toUpperCase();
+            if (method === "USE")
+                continue;
+            const offset = match.index ?? 0;
+            const bodyStart = offset + match[0].length;
+            // A handler passed by reference (`router.get("/x", controller.list)`) has
+            // no body here, so authentication cannot be judged from this file.
+            const head = clean.slice(bodyStart, bodyStart + 200);
+            if (!/=>|function\b/.test(head))
+                continue;
+            const { line, column } = locate(starts, offset);
+            raw.push({
+                method,
+                route: match[2] ?? "/",
+                line,
+                column,
+                bodyStart,
+                end: matches[index + 1]?.index ?? Math.min(clean.length, offset + 4_000),
+            });
+        }
+    }
+    const routes = [];
+    const findings = [];
+    const seen = new Set();
+    let suppressed = 0;
+    for (const route of raw) {
+        const publicRoute = isPublic(route.route, options);
+        routes.push({
+            file,
+            line: route.line,
+            method: route.method,
+            route: route.route,
+            public: publicRoute,
+        });
+        const scope = clean.slice(route.bodyStart, route.end);
+        const rules = [
+            {
+                id: "route-no-auth",
+                severity: "high",
+                hit: !publicRoute && !AUTH.test(scope),
+                message: "маршрут не проверяет аутентификацию — добавьте auth-middleware или проверку сессии",
+            },
+            {
+                id: "idor",
+                severity: "high",
+                hit: REQUEST_ID.test(scope) && LOOKUP.test(scope) && !OWNERSHIP.test(scope),
+                message: "объект ищется по идентификатору из запроса без проверки владельца или тенанта",
+            },
+            {
+                id: "admin-no-guard",
+                severity: "high",
+                hit: ADMIN_PATH.test(route.route) && !ROLE.test(scope),
+                message: "административный маршрут не проверяет роль или разрешение",
+            },
+        ];
+        for (const rule of rules) {
+            if (!rule.hit)
+                continue;
+            const key = `${rule.id}:${String(route.line)}:${String(route.column)}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            if (options.suppressions !== false && suppressionAt(lines, route.line - 1, rule.id)) {
+                suppressed += 1;
+                continue;
+            }
+            findings.push({
+                rule: rule.id,
+                severity: rule.severity,
+                file,
+                line: route.line,
+                column: route.column,
+                method: route.method,
+                route: route.route,
+                message: rule.message,
+            });
+        }
+    }
+    findings.sort((a, b) => a.line - b.line || a.column - b.column || RULE_RANK[a.rule] - RULE_RANK[b.rule]);
+    return { routes, findings, suppressed };
+}
+export function buildAuthzReport(files, results) {
+    const findings = results.flatMap((result) => result.findings);
+    const summary = { high: 0, medium: 0 };
+    for (const finding of findings)
+        summary[finding.severity] += 1;
+    return {
+        files,
+        routes: results.flatMap((result) => result.routes),
+        findings,
+        suppressed: results.reduce((total, result) => total + result.suppressed, 0),
+        summary,
+    };
+}
+export function renderAuthz(report) {
+    const lines = [
+        `Файлов проверено: ${String(report.files)}.`,
+        `Маршрутов найдено: ${String(report.routes.length)}.`,
+        `Найдено: ${String(report.findings.length)} (high ${String(report.summary.high)}, medium ${String(report.summary.medium)}), подавлено: ${String(report.suppressed)}.`,
+    ];
+    if (report.findings.length === 0) {
+        lines.push("Проблем не найдено.");
+    }
+    else {
+        for (const finding of report.findings) {
+            lines.push(`${finding.severity.toUpperCase().padEnd(6)} ${finding.rule.padEnd(16)} ${finding.method} ${finding.route} ${finding.file}:${String(finding.line)} — ${finding.message}`);
+        }
+    }
+    return `${lines.join("\n")}\n`;
+}
+/** SARIF 2.1.0 for code scanning uploads. */
+export function authzSarif(report) {
+    const levels = { high: "error", medium: "warning" };
+    const rules = [...new Set(report.findings.map((finding) => finding.rule))].map((id) => {
+        const finding = report.findings.find((candidate) => candidate.rule === id);
+        return {
+            id: `oc-pilot/${id}`,
+            name: id,
+            shortDescription: { text: finding.message },
+            defaultConfiguration: { level: levels[finding.severity] },
+        };
+    });
+    const results = report.findings.map((finding) => ({
+        ruleId: `oc-pilot/${finding.rule}`,
+        level: levels[finding.severity],
+        message: { text: `${finding.method} ${finding.route}: ${finding.message}` },
+        locations: [
+            {
+                physicalLocation: {
+                    artifactLocation: { uri: finding.file.replace(/\\/g, "/") },
+                    region: { startLine: finding.line, startColumn: finding.column },
+                },
+            },
+        ],
+        properties: { severity: finding.severity, method: finding.method, route: finding.route },
+    }));
+    return `${JSON.stringify({
+        $schema: SARIF_SCHEMA,
+        version: SARIF_VERSION,
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: "oc-pilot",
+                        informationUri: "https://github.com/oc-pilot/oc-pilot",
+                        version: VERSION,
+                        rules,
+                    },
+                },
+                results,
+            },
+        ],
+    }, null, 2)}\n`;
+}
+//# sourceMappingURL=authz.js.map

package/dist/core/authz.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz.js","sourceRoot":"","sources":["../../src/core/authz.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AA8C1C,MAAM,UAAU,GACd,sGAAsG,CAAC;AACzG,MAAM,WAAW,GACf,qHAAqH,CAAC;AAExH,MAAM,IAAI,GACR,+TAA+T,CAAC;AAClU,MAAM,UAAU,GAAG,6EAA6E,CAAC;AACjG,MAAM,MAAM,GACV,+GAA+G,CAAC;AAClH,MAAM,SAAS,GACb,kKAAkK,CAAC;AACrK,MAAM,IAAI,GAAG,6FAA6F,CAAC;AAC3G,MAAM,UAAU,GAAG,uDAAuD,CAAC;AAC3E,MAAM,cAAc,GAClB,wIAAwI,CAAC;AAC3I,MAAM,WAAW,GAAG,qDAAqD,CAAC;AAE1E,MAAM,aAAa,GAAkC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC5E,MAAM,SAAS,GAAgC,EAAE,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;AAEpG,MAAM,UAAU,eAAe,CAAC,KAAoB,EAAE,SAAwB;IAC5E,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,SAAS,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACpE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACnB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB,EAAE,MAAc;IAC9C,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,IAAI,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,OAAO,GAAG,GAAG,IAAI,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3C,IAAI,MAAM,CAAC,MAAM,CAAE,IAAI,MAAM;YAAE,GAAG,GAAG,MAAM,CAAC;;YACvC,IAAI,GAAG,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,GAAG,CAAE,GAAG,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,aAAa,CAAC,KAAe,EAAE,SAAiB,EAAE,IAAY;IACrE,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACtC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAChC,IAAI,UAAU,IAAI,UAAU,KAAK,IAAI;YAAE,SAAS;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,OAAyB;IACxD,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACtG,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI;SACd,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;SAChB,OAAO,CAAC,8BAA8B,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI;SAClB,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC;SACf,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;SAC9C,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACf,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,GAAG,CAAC;QAC3C,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC;QAC1E,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;IACL,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;IACvF,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,IAAI;SAClB,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACf,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,GAAG,CAAC;QAC3C,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC;QAC1E,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;IACL,OAAO,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACtE,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,IAAY,EAAE,UAA4B,EAAE;IACxF,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAe,EAAE,CAAC;IAE3B,MAAM,KAAK,GAAG,0CAA0C,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,4CAA4C,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAE9E,IAAI,KAAK,IAAI,OAAO,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QACjD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACvD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;YAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAChD,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM;gBACN,KAAK;gBACL,IAAI;gBACJ,MAAM;gBACN,SAAS,EAAE,MAAM;gBACjB,GAAG,EAAE,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC,MAAM;aAC/C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC3C,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAChD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACvD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YACjD,IAAI,MAAM,KAAK,KAAK;gBAAE,SAAS;YAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;YAChC,MAAM,SAAS,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAC3C,0EAA0E;YAC1E,mEAAmE;YACnE,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,GAAG,GAAG,CAAC,CAAC;YACrD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC1C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAChD,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM;gBACN,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG;gBACtB,IAAI;gBACJ,MAAM;gBACN,SAAS;gBACT,GAAG,EAAE,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;aACzE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI;YACJ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,WAAW;SACpB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,KAAK,GAAuF;YAChG;gBACE,EAAE,EAAE,eAAe;gBACnB,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;gBACtC,OAAO,EAAE,oFAAoF;aAC9F;YACD;gBACE,EAAE,EAAE,MAAM;gBACV,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC3E,OAAO,EAAE,+EAA+E;aACzF;YACD;gBACE,EAAE,EAAE,gBAAgB;gBACpB,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;gBACtD,OAAO,EAAE,2DAA2D;aACrE;SACF,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,GAAG;gBAAE,SAAS;YACxB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACvE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,IAAI,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBACpF,UAAU,IAAI,CAAC,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,IAAI,CAAC,EAAE;gBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI;gBACJ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACzG,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,OAA0B;IACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAkC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACtE,KAAK,MAAM,OAAO,IAAI,QAAQ;QAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/D,OAAO;QACL,KAAK;QACL,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QAClD,QAAQ;QACR,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QAC3E,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAmB;IAC7C,MAAM,KAAK,GAAG;QACZ,qBAAqB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG;QAC5C,sBAAsB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG;QACrD,YAAY,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG;KACtK,CAAC;IACF,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CACR,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,CACzK,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,UAAU,CAAC,MAAmB;IAC5C,MAAM,MAAM,GAA+C,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAChG,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACpF,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,EAAE,CAAE,CAAC;QAC5E,OAAO;YACL,EAAE,EAAE,YAAY,EAAE,EAAE;YACpB,IAAI,EAAE,EAAE;YACR,gBAAgB,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE;YAC3C,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;SAC1D,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAChD,MAAM,EAAE,YAAY,OAAO,CAAC,IAAI,EAAE;QAClC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC/B,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,OAAO,EAAE,EAAE;QAC3E,SAAS,EAAE;YACT;gBACE,gBAAgB,EAAE;oBAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE;oBAC3D,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE;iBACjE;aACF;SACF;QACD,UAAU,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;KACzF,CAAC,CAAC,CAAC;IACJ,OAAO,GAAG,IAAI,CAAC,SAAS,CACtB;QACE,OAAO,EAAE,YAAY;QACrB,OAAO,EAAE,aAAa;QACtB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,UAAU;wBAChB,cAAc,EAAE,sCAAsC;wBACtD,OAAO,EAAE,OAAO;wBAChB,KAAK;qBACN;iBACF;gBACD,OAAO;aACR;SACF;KACF,EACD,IAAI,EACJ,CAAC,CACF,IAAI,CAAC;AACR,CAAC"}

package/dist/core/authz.test.js

@@ -0,0 +1,115 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { authzSarif, buildAuthzReport, parseAuthzSeverity, renderAuthz, scanAuthzSource, severityAtLeast, } from "./authz.js";
+const EXPRESS = [
+    'const express = require("express");',
+    "const router = express.Router();",
+    'router.get("/users/:id", async (req, res) => {',
+    "  const user = await db.user.findUnique({ where: { id: req.params.id } });",
+    "  res.json(user);",
+    "});",
+    'router.get("/me", async (req, res) => {',
+    "  const user = await db.user.findUnique({ where: { id: req.user.id } });",
+    "  res.json(user);",
+    "});",
+    "",
+].join("\n");
+test("scanAuthzSource flags a route without auth and an IDOR lookup", () => {
+    const result = scanAuthzSource("src/routes.ts", EXPRESS);
+    assert.equal(result.routes.length, 2);
+    assert.equal(result.routes[0]?.route, "/users/:id");
+    assert.equal(result.routes[0]?.method, "GET");
+    assert.deepEqual(result.findings.map((finding) => [finding.route, finding.rule]), [
+        ["/users/:id", "route-no-auth"],
+        ["/users/:id", "idor"],
+    ]);
+    assert.equal(result.findings[0]?.line, 3);
+});
+test("scanAuthzSource keeps authenticated ownership checks quiet", () => {
+    const source = [
+        'router.get("/orders/:id", async (req, res) => {',
+        "  if (!req.user) return res.status(401).end();",
+        "  const order = await db.order.findUnique({ where: { id: req.params.id } });",
+        "  res.json(order);",
+        "});",
+        "",
+    ].join("\n");
+    const result = scanAuthzSource("src/orders.ts", source);
+    assert.deepEqual(result.findings.map((finding) => finding.rule), ["idor"]);
+    const scoped = source.replace("where: { id: req.params.id }", "where: { id: req.params.id, tenantId: req.user.tenantId }");
+    assert.deepEqual(scanAuthzSource("src/orders.ts", scoped).findings, []);
+});
+test("scanAuthzSource guards admin routes with a role check", () => {
+    const open = [
+        'router.post("/admin/users", async (req, res) => {',
+        "  await db.user.create({ data: req.body });",
+        "  res.status(201).end();",
+        "});",
+        "",
+    ].join("\n");
+    assert.deepEqual(scanAuthzSource("src/admin.ts", open).findings.map((finding) => finding.rule), ["route-no-auth", "admin-no-guard"]);
+    const guarded = open.replace("await db.user.create", 'if (req.user.role !== "admin") return res.status(403).end();\n  await db.user.create');
+    assert.deepEqual(scanAuthzSource("src/admin.ts", guarded).findings, []);
+});
+test("scanAuthzSource skips public routes and handlers passed by reference", () => {
+    const publicRoute = 'router.get("/health", async (req, res) => res.json({ ok: true }));\n';
+    const result = scanAuthzSource("src/app.ts", publicRoute);
+    assert.equal(result.routes[0]?.public, true);
+    assert.deepEqual(result.findings, []);
+    const prefixed = scanAuthzSource("src/app.ts", 'router.get("/assets/logo", async () => 1);\n', {
+        publicRoutes: ["/assets"],
+    });
+    assert.deepEqual(prefixed.findings, []);
+    const reference = scanAuthzSource("src/app.ts", 'router.get("/users", controller.list);\n');
+    assert.deepEqual(reference.routes, []);
+});
+test("scanAuthzSource understands Next.js app routes", () => {
+    const source = [
+        "export async function GET(req: Request) {",
+        "  const user = await db.user.findUnique({ where: { id: req.params.id } });",
+        "  return Response.json(user);",
+        "}",
+        "",
+    ].join("\n");
+    const result = scanAuthzSource("app/users/[id]/route.ts", source);
+    assert.equal(result.routes[0]?.route, "/users/:id");
+    assert.equal(result.routes[0]?.method, "GET");
+    assert.deepEqual(result.findings.map((finding) => finding.rule), ["route-no-auth", "idor"]);
+});
+test("scanAuthzSource honours suppressions only with a reason", () => {
+    const source = [
+        "// oc-pilot:authz-ignore idor: доступ ограничен на уровне шлюза",
+        'router.get("/x/:id", async (req, res) => {',
+        "  const item = await db.item.findById(req.params.id);",
+        "  res.json(item);",
+        "});",
+        "",
+    ].join("\n");
+    const result = scanAuthzSource("src/x.ts", source);
+    assert.equal(result.suppressed, 1);
+    assert.deepEqual(result.findings.map((finding) => finding.rule), ["route-no-auth"]);
+    const withoutReason = source.replace(": доступ ограничен на уровне шлюза", ":");
+    assert.equal(scanAuthzSource("src/x.ts", withoutReason).suppressed, 0);
+});
+test("report, render and SARIF describe the findings", () => {
+    const result = scanAuthzSource("src/routes.ts", EXPRESS);
+    const report = buildAuthzReport(1, [result]);
+    assert.equal(report.summary.high, 2);
+    assert.equal(report.routes.length, 2);
+    const text = renderAuthz(report);
+    assert.match(text, /Маршрутов найдено: 2/);
+    assert.match(text, /HIGH\s+route-no-auth/);
+    assert.match(text, /GET \/users\/:id src\/routes\.ts:3/);
+    assert.ok(text.endsWith("\n"));
+    const sarif = JSON.parse(authzSarif(report));
+    assert.equal(sarif.version, "2.1.0");
+    assert.equal(sarif.runs[0]?.results[0]?.ruleId, "oc-pilot/route-no-auth");
+    assert.equal(sarif.runs[0]?.results[0]?.level, "error");
+});
+test("severity helpers accept only high and medium", () => {
+    assert.equal(parseAuthzSeverity("high"), "high");
+    assert.equal(parseAuthzSeverity("low"), undefined);
+    assert.equal(severityAtLeast("high", "medium"), true);
+    assert.equal(severityAtLeast("medium", "high"), false);
+});
+//# sourceMappingURL=authz.test.js.map

package/dist/core/authz.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz.test.js","sourceRoot":"","sources":["../../src/core/authz.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,OAAO,GAAG;IACd,qCAAqC;IACrC,kCAAkC;IAClC,gDAAgD;IAChD,4EAA4E;IAC5E,mBAAmB;IACnB,KAAK;IACL,yCAAyC;IACzC,0EAA0E;IAC1E,mBAAmB;IACnB,KAAK;IACL,EAAE;CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,IAAI,CAAC,+DAA+D,EAAE,GAAG,EAAE;IACzE,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACtC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IACpD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9C,MAAM,CAAC,SAAS,CACd,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,EAC/D;QACE,CAAC,YAAY,EAAE,eAAe,CAAC;QAC/B,CAAC,YAAY,EAAE,MAAM,CAAC;KACvB,CACF,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC5C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4DAA4D,EAAE,GAAG,EAAE;IACtE,MAAM,MAAM,GAAG;QACb,iDAAiD;QACjD,gDAAgD;QAChD,8EAA8E;QAC9E,oBAAoB;QACpB,KAAK;QACL,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACxD,MAAM,CAAC,SAAS,CACd,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAC9C,CAAC,MAAM,CAAC,CACT,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAC3B,8BAA8B,EAC9B,2DAA2D,CAC5D,CAAC;IACF,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAC1E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uDAAuD,EAAE,GAAG,EAAE;IACjE,MAAM,IAAI,GAAG;QACX,mDAAmD;QACnD,6CAA6C;QAC7C,0BAA0B;QAC1B,KAAK;QACL,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,CAAC,SAAS,CACd,eAAe,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAC7E,CAAC,eAAe,EAAE,gBAAgB,CAAC,CACpC,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAC1B,sBAAsB,EACtB,sFAAsF,CACvF,CAAC;IACF,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAC1E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sEAAsE,EAAE,GAAG,EAAE;IAChF,MAAM,WAAW,GAAG,sEAAsE,CAAC;IAC3F,MAAM,MAAM,GAAG,eAAe,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAEtC,MAAM,QAAQ,GAAG,eAAe,CAAC,YAAY,EAAE,8CAA8C,EAAE;QAC7F,YAAY,EAAE,CAAC,SAAS,CAAC;KAC1B,CAAC,CAAC;IACH,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAExC,MAAM,SAAS,GAAG,eAAe,CAAC,YAAY,EAAE,0CAA0C,CAAC,CAAC;IAC5F,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACzC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC1D,MAAM,MAAM,GAAG;QACb,2CAA2C;QAC3C,4EAA4E;QAC5E,+BAA+B;QAC/B,GAAG;QACH,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,MAAM,GAAG,eAAe,CAAC,yBAAyB,EAAE,MAAM,CAAC,CAAC;IAClE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IACpD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9C,MAAM,CAAC,SAAS,CACd,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAC9C,CAAC,eAAe,EAAE,MAAM,CAAC,CAC1B,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yDAAyD,EAAE,GAAG,EAAE;IACnE,MAAM,MAAM,GAAG;QACb,iEAAiE;QACjE,4CAA4C;QAC5C,uDAAuD;QACvD,mBAAmB;QACnB,KAAK;QACL,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACnC,MAAM,CAAC,SAAS,CACd,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAC9C,CAAC,eAAe,CAAC,CAClB,CAAC;IAEF,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;IAChF,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AACzE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC1D,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAEtC,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;IAC3C,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;IAC3C,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,oCAAoC,CAAC,CAAC;IACzD,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAE/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAG1C,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,wBAAwB,CAAC,CAAC;IAC1E,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AAC1D,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8CAA8C,EAAE,GAAG,EAAE;IACxD,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;AACzD,CAAC,CAAC,CAAC"}