progmune-runtime 3.7.13 → 3.7.15

package/dist/frameworks/hapi-detector.js

@@ -56,6 +56,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.analyzeHapiApp = analyzeHapiApp;
 exports.analyzeHapiFile = analyzeHapiFile;
 const fs = __importStar(require("fs"));
+const route_window_1 = require("./route-window");
 const MUTATION_METHODS = new Set(["post", "put", "patch", "delete"]);
 const AUTH_ENTRY_WORDS = [
     "login", "signin", "sign_in", "regist", "signup", "sign_up",
@@ -66,11 +67,56 @@ function isAuthEntryPath(pathName) {
     return AUTH_ENTRY_WORDS.some((w) => lower.includes(w));
 }
 // ── Analysis（代码串级） ──
+/** 声明式 hapi 路由模块（V6 遗留缺口）：真实 hapi 应用（glue/pal/插件）
+ * 以数组声明路由——module.exports = (server) => [ { method, path,
+ *   config: { auth: 'jwt', ... }, handler }, ... ]，由框架注册；
+ * 文件本身无 require('hapi')、无 server.route 调用 */
+function isDeclarativeHapiModule(code) {
+    const hasRouteObject = /method\s*:\s*['"](GET|POST|PUT|PATCH|DELETE|get|post|put|patch|delete)['"]/.test(code) &&
+        /path\s*:\s*['"]/.test(code) &&
+        /\b(?:config|options)\s*:/.test(code);
+    if (!hasRouteObject)
+        return false;
+    return (/module\.exports\s*=\s*\(?\s*server\b/.test(code) ||
+        /module\.exports\s*=\s*function\s*\(\s*server\b/.test(code) ||
+        /return\s*\[/.test(code));
+}
+/** 自 routeObjStart('{') 取平衡块文本（含嵌套 config 对象；字符串感知） */
+function hapiBalancedBlock(code, openIdx) {
+    let depth = 1;
+    let end = openIdx + 1;
+    let quote = null;
+    while (end < code.length && depth > 0) {
+        const ch = code[end];
+        if (quote) {
+            if (ch === quote && code[end - 1] !== "\\")
+                quote = null;
+        }
+        else if (ch === '"' || ch === "'" || ch === "`") {
+            quote = ch;
+        }
+        else if (ch === "{") {
+            depth++;
+        }
+        else if (ch === "}") {
+            depth--;
+        }
+        end++;
+    }
+    return code.slice(openIdx + 1, Math.max(openIdx + 1, end - 1));
+}
+function hapiAuthOption(block) {
+    const authM = block.match(/\bauth\s*:\s*(?:['"]([^'"]+)['"]|\{\s*strategy\s*:\s*['"]([^'"]+)['"]|\s*(false|true))/);
+    if (!authM)
+        return null;
+    return authM[3] === "false" ? "false" : authM[1] || authM[2] || authM[3] || null;
+}
 function analyzeHapiApp(code) {
     const issues = [];
     const routes = [];
     const strategies = [];
-    const hasHapi = /@hapi\/hapi|\bHapi\.server\b|\bhapi\.server\b/.test(code);
+    // @hapi-scoped（v17+）、v16 require('hapi'），或声明式数组模块（V6 修复）
+    const hasHapi = /@hapi\/hapi|\bHapi\.server\b|\bhapi\.server\b|require\(\s*['"]hapi['"]\s*\)|from\s+['"]hapi['"]/.test(code) || isDeclarativeHapiModule(code);
     if (!hasHapi) {
         return { hasHapi: false, routes, strategies, issues };
     }
@@ -80,43 +126,69 @@ function analyzeHapiApp(code) {
     while ((m = strategyRe.exec(code)) !== null) {
         strategies.push(m[1]);
     }
-    // 路由块：server.route({ ... }) —— 从 route( 向后截 500 字符窗口
-    const routeRe = /\.route\s*\(\s*\{/g;
-    while ((m = routeRe.exec(code)) !== null) {
-        const window = code.slice(m.index, m.index + 500);
-        const methodM = window.match(/method\s*:\s*['"]([^'"]+)['"]/);
-        const pathM = window.match(/path\s*:\s*['"]([^'"]+)['"]/);
-        const authM = window.match(/auth\s*:\s*(?:['"]([^'"]+)['"]|\{\s*strategy\s*:\s*['"]([^'"]+)['"]|\s*(false|true))/);
-        if (!methodM || !pathM)
+    const declarative = isDeclarativeHapiModule(code);
+    const lineAt = (idx) => code.slice(0, idx).split("\n").length;
+    if (!declarative) {
+        // 直连形态：server.route({ ... }) —— 500 字符窗口
+        const routeRe = /\.route\s*\(\s*\{/g;
+        while ((m = routeRe.exec(code)) !== null) {
+            const window = code.slice(m.index, m.index + 500);
+            const methodM = window.match(/method\s*:\s*['"]([^'"]+)['"]/);
+            const pathM = window.match(/path\s*:\s*['"]([^'"]+)['"]/);
+            if (!methodM || !pathM)
+                continue;
+            routes.push({
+                method: methodM[1].toLowerCase(),
+                path: pathM[1],
+                authOption: hapiAuthOption(window),
+                line: lineAt(m.index),
+            });
+        }
+    }
+    else {
+        // 声明式数组：每个 { method, path, config:{auth} } 路由对象
+        const verbRe = /method\s*:\s*['"](GET|POST|PUT|PATCH|DELETE|get|post|put|patch|delete)['"]/g;
+        while ((m = verbRe.exec(code)) !== null) {
+            const verb = m[1].toLowerCase();
+            const verbLine = lineAt(m.index);
+            const objStart = code.lastIndexOf("{", m.index);
+            if (objStart < 0)
+                continue;
+            const block = hapiBalancedBlock(code, objStart);
+            const pathM = block.match(/path\s*:\s*['"]([^'"]+)['"]/);
+            if (!pathM)
+                continue;
+            // 重复对象去重
+            if (routes.some((r) => r.line === verbLine && r.method === verb))
+                continue;
+            routes.push({
+                method: verb,
+                path: pathM[1],
+                authOption: hapiAuthOption(block),
+                line: verbLine,
+            });
+        }
+    }
+    // register 集合豁免（语义层，同其他框架）：users/login 姊妹 → POST users 公开
+    const registerRoots = (0, route_window_1.collectRegisterRoots)(routes.map((r) => r.path));
+    for (const r of routes) {
+        if (!MUTATION_METHODS.has(r.method))
             continue;
-        const method = methodM[1].toLowerCase();
-        const pathName = pathM[1];
-        // auth: false → 显式公开；无 auth 字段 → authM null
-        const authOption = authM
-            ? (authM[3] === "false" ? "false" : authM[1] || authM[2] || authM[3] || null)
-            : null;
-        routes.push({
-            method,
-            path: pathName,
-            authOption,
-            line: code.slice(0, m.index).split("\n").length,
-        });
-        if (!MUTATION_METHODS.has(method))
+        if (isAuthEntryPath(r.path))
             continue;
-        if (isAuthEntryPath(pathName))
+        if (r.method === "post" && (0, route_window_1.isRegisterRoot)(r.path, registerRoots))
             continue;
-        // 无 auth 字段（authOption null 且非显式 false 已涵盖）或显式 false → 报
-        if (authOption === null || authOption === "false") {
+        if (r.authOption === null || r.authOption === "false") {
             issues.push({
                 severity: "medium",
                 rule: "HAPI_ROUTE_NO_AUTH",
-                message: authOption === "false"
-                    ? `Mutation route ${method.toUpperCase()} ${pathName} is explicitly ` +
+                message: r.authOption === "false"
+                    ? `Mutation route ${r.method.toUpperCase()} ${r.path} is explicitly ` +
                         `public (auth: false) — any caller can reach it.`
-                    : `Mutation route ${method.toUpperCase()} ${pathName} has no auth ` +
+                    : `Mutation route ${r.method.toUpperCase()} ${r.path} has no auth ` +
                         `option in its route config — any caller can reach it.`,
-                route: `${method.toUpperCase()} ${pathName}`,
-                line: code.slice(0, m.index).split("\n").length,
+                route: `${r.method.toUpperCase()} ${r.path}`,
+                line: r.line,
             });
         }
     }
@@ -126,7 +198,9 @@ function analyzeHapiFile(filePath) {
     if (!fs.existsSync(filePath))
         return null;
     const code = fs.readFileSync(filePath, "utf-8");
-    if (!/@hapi\/hapi|@hapi\/hawk|\bHapi\.server\b/.test(code))
+    // gate：@hapi-scoped / v16 require('hapi') / 声明式数组模块
+    const marker = /@hapi\/hapi|@hapi\/hawk|\bHapi\.server\b|require\(\s*['"]hapi['"]\s*\)|from\s+['"]hapi['"]/.test(code) || isDeclarativeHapiModule(code);
+    if (!marker)
         return null;
     return analyzeHapiApp(code);
 }

package/dist/frameworks/hapi-detector.test.js

@@ -58,3 +58,94 @@ server.route({ method: "POST", path: "/login", handler: () => "token" });
         (0, vitest_1.expect)(issues).toHaveLength(0);
     });
 });
+// ── V6 修复轮回归：v16 时代 require('hapi') gate 兼容 ──
+(0, vitest_1.describe)("hapi-detector V6 gate 修复回归", () => {
+    (0, vitest_1.it)("v16 形态 require('hapi') + server.route 可被分析（旧 gate 只认 @hapi-scoped）", () => {
+        const code = `
+const Hapi = require("hapi");
+const server = new Hapi.Server();
+server.connection({ port: 3000 });
+server.auth.strategy("jwt", "jwt", { key: "s" });
+server.route({ method: "POST", path: "/articles", config: { auth: "jwt" }, handler: (r, reply) => reply({}) });
+server.route({ method: "POST", path: "/payments", handler: (r, reply) => reply({}) });
+`;
+        const { hasHapi, strategies, routes, issues } = (0, hapi_detector_1.analyzeHapiApp)(code);
+        (0, vitest_1.expect)(hasHapi).toBe(true);
+        (0, vitest_1.expect)(strategies).toContain("jwt");
+        const articles = routes.find((r) => r.path === "/articles");
+        const payments = routes.find((r) => r.path === "/payments");
+        (0, vitest_1.expect)(articles).toBeDefined();
+        (0, vitest_1.expect)(articles.authOption).toBe("jwt"); // config.auth 嵌套亦被窗口文本捕获
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("HAPI_ROUTE_NO_AUTH");
+        (0, vitest_1.expect)(issues.map((i) => i.route)).not.toContain("POST /articles");
+    });
+    (0, vitest_1.it)("gate 不误收 hapi-auth-jwt2（require('hapi') 需闭合引号紧随）", () => {
+        const { hasHapi } = (0, hapi_detector_1.analyzeHapiApp)(`
+const hapiAuth = require("hapi-auth-jwt2");
+module.exports = (server) => { return []; };
+`);
+        (0, vitest_1.expect)(hasHapi).toBe(false);
+    });
+});
+// ── V6 遗留缺口：声明式数组路由 + config.auth 嵌套 ──
+const DECLARATIVE = `
+module.exports = (server) => {
+  const handlers = require('./handlers')(server)
+  return [
+    // GET 公开
+    {
+      method: 'GET',
+      path: '/articles',
+      config: { description: 'list' },
+      handler: handlers.list
+    },
+    // mutation 受保护（config.auth 嵌套）
+    {
+      method: 'POST',
+      path: '/articles',
+      config: { auth: 'jwt', response: {} },
+      handler: handlers.create
+    },
+    // 无认证 mutation
+    {
+      method: 'POST',
+      path: '/payments',
+      config: {},
+      handler: handlers.pay
+    }
+  ]
+}
+`;
+const DECLARATIVE_USERS = `
+module.exports = (server) => {
+  return [
+    { method: 'POST', path: '/users/login', config: {}, handler: h },
+    { method: 'POST', path: '/users', config: {}, handler: h },
+    { method: 'PUT', path: '/user', config: { auth: 'jwt' }, handler: h }
+  ]
+}
+`;
+(0, vitest_1.describe)("hapi 声明式数组路由（V6 修复回归）", () => {
+    (0, vitest_1.it)("module.exports=(server)+数组路由对象被识别，config.auth 保护生效", () => {
+        const { hasHapi, routes, issues } = (0, hapi_detector_1.analyzeHapiApp)(DECLARATIVE);
+        (0, vitest_1.expect)(hasHapi).toBe(true);
+        (0, vitest_1.expect)(routes.length).toBe(3);
+        const create = routes.find((r) => r.method === "post" && r.path === "/articles");
+        (0, vitest_1.expect)(create.authOption).toBe("jwt");
+        const missing = issues.filter((i) => i.rule === "HAPI_ROUTE_NO_AUTH").map((i) => i.route);
+        (0, vitest_1.expect)(missing).toContain("POST /payments");
+        (0, vitest_1.expect)(missing).not.toContain("POST /articles");
+    });
+    (0, vitest_1.it)("摘 config.auth → mutation 报（敏感性）", () => {
+        const stripped = DECLARATIVE.replace("config: { auth: 'jwt', response: {} }", "config: { response: {} }");
+        const { issues } = (0, hapi_detector_1.analyzeHapiApp)(stripped);
+        (0, vitest_1.expect)(issues.some((i) => i.rule === "HAPI_ROUTE_NO_AUTH" && i.route === "POST /articles")).toBe(true);
+    });
+    (0, vitest_1.it)("register/login 公开：users/login + users（姊妹佐证）不报", () => {
+        const { issues } = (0, hapi_detector_1.analyzeHapiApp)(DECLARATIVE_USERS);
+        const missing = issues.filter((i) => i.rule === "HAPI_ROUTE_NO_AUTH").map((i) => i.route);
+        (0, vitest_1.expect)(missing).not.toContain("POST /users/login");
+        (0, vitest_1.expect)(missing).not.toContain("POST /users");
+        (0, vitest_1.expect)(missing).not.toContain("PUT /user");
+    });
+});

package/dist/frameworks/koa-detector.js

@@ -55,6 +55,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.analyzeKoaApp = analyzeKoaApp;
 exports.analyzeKoaFile = analyzeKoaFile;
 const fs = __importStar(require("fs"));
+const route_window_1 = require("./route-window");
 const MUTATION_METHODS = new Set(["post", "put", "patch", "delete", "del"]);
 const AUTH_ENTRY_WORDS = [
     "login", "signin", "sign_in", "regist", "signup", "sign_up",
@@ -89,14 +90,18 @@ function analyzeKoaApp(code) {
             authGlobalMiddleware.push(m[1]);
     }
     // 路由注册：router.post('/x', mw1, mw2, handler) / .del()
-    const routeRe = /\.(get|post|put|patch|delete|del)\s*\(\s*['"]([^'"]+)['"]/g;
+    // 接收者限定 router/*Router/app——config.get('secret') 之类不再被当路由
+    const routeRe = /\b(?:router|[A-Za-z_$][\w$]*[Rr]outer|app)\s*\.(get|post|put|patch|delete|del)\s*\(\s*['"]([^'"]+)['"]/g;
     while ((m = routeRe.exec(code)) !== null) {
         const method = m[1].toLowerCase() === "del" ? "delete" : m[1].toLowerCase();
         const pathName = m[2];
-        // 从路径串向后截 300 字符窗口，收集中间件名（认证名判定）
-        const windowStart = m.index + m[0].length;
-        const window = code.slice(windowStart, windowStart + 300);
-        const mwNames = window.match(/[A-Za-z_$][\w$]*/g) || [];
+        // 认证名收集窗口 = 本次路由调用（自路径串后至本调用闭合括号），
+        // 不跨路由边界——修复 300 字符前向窗口跨路由串扰（bleed）缺陷：
+        // 后面路由的 auth 名不再把前面的公开路由洗成 protected
+        const window = (0, route_window_1.routeCallWindow)(code, m.index + m[0].length);
+        // koa-router 语义：(path, ...middleware, handler)——末参 handler 由
+        // middlewareNamesFromWindow 排除，handler 名（如 ctrl.login）不再误判
+        const mwNames = (0, route_window_1.middlewareNamesFromWindow)(window);
         const hasAuthMw = mwNames.some((name) => isAuthFnName(name));
         routes.push({
             method,
@@ -104,15 +109,25 @@ function analyzeKoaApp(code) {
             protected: hasAuthMw,
             line: code.slice(0, m.index).split("\n").length,
         });
-        if (MUTATION_METHODS.has(method) && !hasAuthMw
-            && authGlobalMiddleware.length === 0 && !isAuthEntryPath(pathName)) {
+    }
+    // register 集合豁免（语义层）：同文件存在 <path>/login|register|signup…
+    // 姊妹路由 ⇒ <path> 是账户集合，其无认证 POST = 公开注册（realworld
+    // 惯用 POST /users 而非 /register——路径豁免词表认不出，Koa 语料
+    // 1/1 register FP 的根因）。有 login 佐证才豁免：管理员建用户类
+    // 端点（无姊妹 login）仍会报
+    const registerRoots = (0, route_window_1.collectRegisterRoots)(routes.map((r) => r.path));
+    for (const r of routes) {
+        if (MUTATION_METHODS.has(r.method) && !r.protected
+            && authGlobalMiddleware.length === 0
+            && !isAuthEntryPath(r.path)
+            && !(r.method === "post" && (0, route_window_1.isRegisterRoot)(r.path, registerRoots))) {
             issues.push({
                 severity: "medium",
                 rule: "KOA_ROUTE_NO_AUTH",
-                message: `Route ${method.toUpperCase()} ${pathName} has no auth middleware ` +
+                message: `Route ${r.method.toUpperCase()} ${r.path} has no auth middleware ` +
                     `and the app registers no auth middleware — any caller can reach it.`,
-                route: `${method.toUpperCase()} ${pathName}`,
-                line: code.slice(0, m.index).split("\n").length,
+                route: `${r.method.toUpperCase()} ${r.path}`,
+                line: r.line,
             });
         }
     }

package/dist/frameworks/koa-detector.test.js

@@ -54,4 +54,42 @@ router.post("/login", async (ctx) => { ctx.body = "token"; });
         (0, vitest_1.expect)(hasKoa).toBe(false);
         (0, vitest_1.expect)(issues).toHaveLength(0);
     });
+    (0, vitest_1.it)("回归：窗口不跨路由串扰——公开路由后面的 auth 路由不再把它洗成 protected（修复 300 字符 bleed）", () => {
+        const { issues, routes } = (0, koa_detector_1.analyzeKoaApp)(app(`
+router.post("/users", ctrl.post);            // 公开 register —— 应报
+router.post("/articles", auth, ctrl.create); // 受保护 —— 不报
+`));
+        const register = routes.find((r) => r.path === "/users");
+        const article = routes.find((r) => r.path === "/articles");
+        (0, vitest_1.expect)(register.protected).toBe(false);
+        (0, vitest_1.expect)(article.protected).toBe(true);
+        (0, vitest_1.expect)(issues.map((i) => i.route)).toContain("POST /users");
+        (0, vitest_1.expect)(issues.map((i) => i.route)).not.toContain("POST /articles");
+    });
+    (0, vitest_1.it)("回归：config.get('secret') 不再是幻影路由（接收者限定 router/app）", () => {
+        const { routes } = (0, koa_detector_1.analyzeKoaApp)(app(`
+const secret = config.get("secret");
+router.post("/x", auth, h);
+`));
+        (0, vitest_1.expect)(routes.map((r) => r.path)).not.toContain("secret");
+        (0, vitest_1.expect)(routes.map((r) => r.path)).toContain("/x");
+    });
+});
+(0, vitest_1.describe)("koa-detector register 集合豁免（语义层）", () => {
+    (0, vitest_1.it)("有 /users/login 姊妹佐证：POST /users（公开注册）不报", () => {
+        const { issues } = (0, koa_detector_1.analyzeKoaApp)(app(`
+router.post("/users/login", ctrl.login);
+router.post("/users", ctrl.register);
+router.post("/articles", auth, ctrl.create);
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.route)).not.toContain("POST /users");
+        (0, vitest_1.expect)(issues.map((i) => i.route)).not.toContain("POST /users/login");
+        (0, vitest_1.expect)(issues.map((i) => i.route)).not.toContain("POST /articles");
+    });
+    (0, vitest_1.it)("无姊妹佐证：POST /users 仍报（管理员建用户类端点不豁免）", () => {
+        const { issues } = (0, koa_detector_1.analyzeKoaApp)(app(`
+router.post("/users", ctrl.createUser);
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.route)).toContain("POST /users");
+    });
 });

package/dist/frameworks/nestjs-detector.js

@@ -20,6 +20,7 @@ exports.analyzeNestJSProject = analyzeNestJSProject;
 exports.analyzeNestJSFile = analyzeNestJSFile;
 exports.formatNestJSReport = formatNestJSReport;
 const ts_morph_1 = require("ts-morph");
+const route_window_1 = require("./route-window");
 // ── Core Analysis ──
 function analyzeNestJSProject(projectRoot) {
     let project;
@@ -64,6 +65,60 @@ function analyzeNestJSProject(projectRoot) {
         }
     }
     const hasGlobalAuthGuard = analysis.globalAuthGuards.length > 0;
+    // ── 第二遍：模块级中间件保护（Nest 5 时代惯用法）──
+    // class XxxModule implements NestModule { configure(consumer) {
+    //   consumer.apply(AuthMiddleware).forRoutes({path, method}, ...) } }
+    // 覆盖关系：controller → [{path, methods}]（REALWORLD_STRUCTURAL_V1：
+    // guard 单一模型漏掉 configure/forRoutes 中间件保护 → 23 issues 全 FP）
+    const ctrlMiddleware = new Map();
+    for (const file of project.getSourceFiles()) {
+        if (file.getFilePath().includes("node_modules"))
+            continue;
+        for (const cls of file.getClasses()) {
+            const moduleDec = cls.getDecorator("Module");
+            if (!moduleDec)
+                continue;
+            const configure = cls.getMethods().find((mm) => mm.getName() === "configure");
+            if (!configure)
+                continue;
+            const coverage = extractMiddlewareForRoutes(configure.getText());
+            if (coverage.length === 0)
+                continue;
+            // 该模块声明管哪些 controller
+            const ctrlNames = extractModuleControllerNames(moduleDec);
+            for (const c of ctrlNames) {
+                const merged = ctrlMiddleware.get(c) || [];
+                merged.push(...coverage);
+                ctrlMiddleware.set(c, merged);
+            }
+        }
+    }
+    // ── register 集合豁免预扫（语义层）──
+    // 项目级收集账户入口路由（*\/login|register|signup…）→ 集合根
+    // （/users/login → /users）；该集合的 POST = 公开注册（realworld 惯用
+    // POST /users——register FP 跨框架根因）。POST-only：同集合的 PUT 等
+    // 不豁免；无 login 姊妹佐证的写集合（管理员建用户）仍查
+    const allRoutePaths = [];
+    for (const file of project.getSourceFiles()) {
+        if (file.getFilePath().includes("node_modules"))
+            continue;
+        if (/\.(test|spec)\.ts$/.test(file.getFilePath()))
+            continue;
+        for (const cls of file.getClasses()) {
+            const ctrlDec = cls.getDecorator("Controller");
+            if (!ctrlDec)
+                continue;
+            const basePath = getStringArg(ctrlDec, 0) || "";
+            for (const method of cls.getMethods()) {
+                const http = getHttpMethod(method);
+                if (!http)
+                    continue;
+                const routePath = getStringArg(method.getDecorators().find((d) => isHttpDecorator(d)), 0) || "";
+                allRoutePaths.push(basePath + (routePath.startsWith("/") ? routePath : `/${routePath}`));
+            }
+        }
+    }
+    const registerRoots = (0, route_window_1.collectRegisterRoots)(allRoutePaths);
     for (const file of project.getSourceFiles()) {
         // Skip node_modules and test files
         if (file.getFilePath().includes("node_modules"))
@@ -111,13 +166,16 @@ function analyzeNestJSProject(projectRoot) {
                     isPublicDecorated,
                 };
                 analysis.routes.push(route);
-                // 路由级保护判定：类/方法认证守卫，或全局 APP_GUARD（除非 @Public 豁免）
+                // 路由级保护判定：类/方法认证守卫，或全局 APP_GUARD（除非 @Public 豁免），
+                // 或模块级中间件 forRoutes 覆盖（Nest 5 惯用法）
                 const protectedByGlobal = hasGlobalAuthGuard && !isPublicDecorated;
+                const protectedByMiddleware = middlewareCovers(ctrlMiddleware, controllerName, httpMethod, fullPath);
                 // ── Security Checks ──
                 // POST/PUT/DELETE without auth guard
                 // Skip intentionally public routes (login, register, health, etc.)
                 if (["POST", "PUT", "DELETE", "PATCH"].includes(httpMethod) && !isPublicRoute(fullPath)) {
-                    if (!route.hasAuthGuard && !protectedByGlobal) {
+                    const isRegisterPost = httpMethod === "POST" && (0, route_window_1.isRegisterRoot)(fullPath, registerRoots);
+                    if (!route.hasAuthGuard && !protectedByGlobal && !protectedByMiddleware && !isRegisterPost) {
                         analysis.issues.push({
                             type: "NESTJS_NO_AUTH",
                             severity: "critical",
@@ -145,7 +203,7 @@ function analyzeNestJSProject(projectRoot) {
                 if (httpMethod === "GET") {
                     const sensitiveTerms = ["admin", "private", "secret", "manage"];
                     if (sensitiveTerms.some(t => fullPath.toLowerCase().includes(t))
-                        && !route.hasAuthGuard && !protectedByGlobal) {
+                        && !route.hasAuthGuard && !protectedByGlobal && !protectedByMiddleware) {
                         analysis.issues.push({
                             type: "NESTJS_SENSITIVE_PUBLIC",
                             severity: "high",
@@ -216,6 +274,90 @@ function extractAppGuardNames(moduleDec, cls) {
     }
     return names;
 }
+// ── 模块级中间件覆盖（Nest 5 configure/forRoutes 惯用法）──
+/** 从 configure(consumer) 方法文本提取 forRoutes 覆盖：{path, methods[]} */
+function extractMiddlewareForRoutes(configureText) {
+    const out = [];
+    // consumer.apply(X).forRoutes({...}, {...}) / .forRoutes('path', ...)
+    const frIndexes = [];
+    let idx = 0;
+    while ((idx = configureText.indexOf(".forRoutes(", idx)) !== -1) {
+        frIndexes.push(idx + ".forRoutes(".length);
+        idx += ".forRoutes(".length;
+    }
+    for (const start of frIndexes) {
+        // 括号平衡取 forRoutes 参数块
+        let depth = 1;
+        let end = start;
+        while (end < configureText.length && depth > 0) {
+            if (configureText[end] === "(")
+                depth++;
+            else if (configureText[end] === ")")
+                depth--;
+            end++;
+        }
+        const argsText = configureText.slice(start, end - 1);
+        // 逐顶层参数（逗号切分，深度感知）
+        const args = [];
+        let cur = "";
+        let d = 0;
+        for (const ch of argsText) {
+            if (ch === "(" || ch === "[" || ch === "{")
+                d++;
+            else if (ch === ")" || ch === "]" || ch === "}")
+                d--;
+            if (ch === "," && d === 0) {
+                args.push(cur);
+                cur = "";
+            }
+            else
+                cur += ch;
+        }
+        if (cur.trim())
+            args.push(cur);
+        for (const arg of args) {
+            const trimmed = arg.trim();
+            const pathM = trimmed.match(/path\s*:\s*['"]([^'"]+)['"]/);
+            const methodM = trimmed.match(/method\s*:\s*RequestMethod\.(\w+)/);
+            const plain = trimmed.match(/^['"]([^'"]+)['"]$/);
+            const path = pathM ? pathM[1] : plain ? plain[1] : null;
+            if (!path)
+                continue;
+            const method = methodM ? methodM[1] : "*";
+            out.push({ path, methods: [method] });
+        }
+    }
+    return out;
+}
+/** @Module({ controllers: [A, B] }) 里的控制器类名 */
+function extractModuleControllerNames(moduleDec) {
+    const out = [];
+    const text = moduleDec.getText();
+    const m = text.match(/controllers\s*:\s*\[([^\]]*)\]/);
+    if (!m)
+        return out;
+    for (const name of m[1].split(",")) {
+        const n = name.trim().replace(/\s+as\s+\w+$/, "").split(".").pop();
+        if (n && /^[A-Za-z_$]/.test(n))
+            out.push(n);
+    }
+    return out;
+}
+/** route（method, fullPath）是否被 controller 的模块中间件覆盖 */
+function middlewareCovers(ctrlMiddleware, controllerName, httpMethod, fullPath) {
+    const entries = ctrlMiddleware.get(controllerName);
+    if (!entries || entries.length === 0)
+        return false;
+    const norm = (p) => p.replace(/^\/+|\/+$/g, "");
+    const routePath = norm(fullPath);
+    return entries.some((e) => {
+        const em = e.methods[0] || "*";
+        // RequestMethod.ALL 与通配 * 匹配任意方法
+        if (em !== "*" && em !== "ALL" && em !== httpMethod)
+            return false;
+        return norm(e.path) === routePath;
+    });
+}
 /** Check if a route is intentionally public (login, register, health, etc.). */
 function isPublicRoute(path) {
     // Normalize: ensure leading slash for consistent matching