progmune-runtime 3.7.14 → 3.7.16

package/dist/frameworks/fiber-detector.js

@@ -53,7 +53,14 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.analyzeFiberApp = analyzeFiberApp;
 exports.analyzeFiberFile = analyzeFiberFile;
+exports.fiberFuncStarts = fiberFuncStarts;
+exports.fiberEnclosingFunc = fiberEnclosingFunc;
+exports.fiberProtectedRegisterFns = fiberProtectedRegisterFns;
+exports.analyzeFiberProject = analyzeFiberProject;
+exports.goFuncsOf = goFuncsOf;
+exports.fiberProjectProtectedFns = fiberProjectProtectedFns;
 const fs = __importStar(require("fs"));
+const route_window_1 = require("./route-window");
 const MUTATION_METHODS = new Set(["post", "put", "patch", "delete"]);
 const AUTH_ENTRY_WORDS = [
     "login", "signin", "sign_in", "regist", "signup", "sign_up",
@@ -81,19 +88,22 @@ function analyzeFiberApp(code) {
         return { hasFiber: false, routes, authMiddleware, issues };
     }
     // 全局/组级认证中间件：app.Use(authMW) / group.Use(authMW)
-    const useRe = /\.Use\s*\(\s*([A-Za-z_][\w]*)/g;
+    // 捕获支持点限定成员（jwtware.New 前的一般为 middleware.Protected 等）
+    const useRe = /\.Use\s*\(\s*([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)/g;
     let m;
     while ((m = useRe.exec(code)) !== null) {
         if (isAuthFnName(m[1]))
             authMiddleware.push(m[1]);
     }
     // 路由注册：app.Post("/x", mw1, mw2, handler)——Go 方法名大写（Post 惯例）
-    const routeRe = /\.(get|post|put|patch|delete)\s*\(\s*"([^"]+)"/gi;
+    // 空路径 "..." 允许
+    const routeRe = /\.(get|post|put|patch|delete)\s*\(\s*"([^"]*)"(\s*,\s*|\s*\))/gi;
     while ((m = routeRe.exec(code)) !== null) {
         const method = m[1].toLowerCase();
         const pathName = m[2];
-        const window = code.slice(m.index + m[0].length, m.index + m[0].length + 300);
-        const mwNames = window.match(/[A-Za-z_][\w]*/g) || [];
+        // 认证窗口 = 本次调用边界内（括号感知），不跨路由（V8 缺陷修复）
+        const window = (0, route_window_1.routeCallWindow)(code, m.index + m[0].length);
+        const mwNames = (0, route_window_1.middlewareNamesFromWindow)(window);
         const hasAuthMw = mwNames.some((name) => isAuthFnName(name));
         routes.push({
             method,
@@ -101,15 +111,21 @@ function analyzeFiberApp(code) {
             protected: hasAuthMw,
             line: code.slice(0, m.index).split("\n").length,
         });
-        if (MUTATION_METHODS.has(method) && !hasAuthMw
-            && authMiddleware.length === 0 && !isAuthEntryPath(pathName)) {
+    }
+    // register 集合豁免（语义层，同 Koa/Gin）
+    const registerRoots = (0, route_window_1.collectRegisterRoots)(routes.map((r) => r.path));
+    for (const r of routes) {
+        if (MUTATION_METHODS.has(r.method) && !r.protected
+            && authMiddleware.length === 0
+            && !isAuthEntryPath(r.path)
+            && !(r.method === "post" && (0, route_window_1.isRegisterRoot)(r.path, registerRoots))) {
             issues.push({
                 severity: "medium",
                 rule: "FIBER_ROUTE_NO_AUTH",
-                message: `Route ${method.toUpperCase()} ${pathName} has no auth middleware ` +
+                message: `Route ${r.method.toUpperCase()} ${r.path} has no auth middleware ` +
                     `and no auth Use middleware — any caller can reach it.`,
-                route: `${method.toUpperCase()} ${pathName}`,
-                line: code.slice(0, m.index).split("\n").length,
+                route: `${r.method.toUpperCase()} ${r.path}`,
+                line: r.line,
             });
         }
     }
@@ -123,3 +139,244 @@ function analyzeFiberFile(filePath) {
         return null;
     return analyzeFiberApp(code);
 }
+/** 顶层函数头（行号 1-based） */
+function fiberFuncStarts(text) {
+    const out = [];
+    const re = /^func\s+([A-Za-z_]\w*)\s*\(/gm;
+    let m;
+    while ((m = re.exec(text)) !== null) {
+        out.push({ name: m[1], line: text.slice(0, m.index).split("\n").length });
+    }
+    return out;
+}
+/** routeLine 所在顶层函数名 */
+function fiberEnclosingFunc(text, routeLine) {
+    let name = null;
+    for (const f of fiberFuncStarts(text)) {
+        if (f.line <= routeLine)
+            name = f.name;
+        else
+            break;
+    }
+    return name;
+}
+/** bootstrap 相位推导：认证 Use 之后调用的 Register fn（组编号 1,2|3,4|5,6|7,8） */
+function fiberProtectedRegisterFns(bootstrapText) {
+    const state = new Map();
+    const protectedFns = new Map();
+    const re = /(\w+)\s*(?::=|=)\s*fiber\.New\s*\(|(\w+)\.Use\s*\(\s*([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)|(\w+)\s*(?::=|=)\s*(?:[\w.]*\.)?([A-Za-z_]\w*)\.Group\s*\(|(?:[\w.]*\.)?([A-Z][A-Za-z0-9_]*)\s*\(\s*(?:[\w.]*\.)?([A-Za-z_]\w*)\.Group\s*\(/g;
+    let m;
+    while ((m = re.exec(bootstrapText)) !== null) {
+        if (m[1] !== undefined) {
+            state.set(m[1], false);
+        }
+        else if (m[2] !== undefined) {
+            if (isAuthFnName(m[3]))
+                state.set(m[2], true);
+        }
+        else if (m[4] !== undefined) {
+            state.set(m[4], !!state.get(m[5]));
+        }
+        else if (m[6] !== undefined) {
+            if (state.get(m[7]))
+                protectedFns.set(m[6], true);
+        }
+    }
+    return protectedFns;
+}
+/** 项目级分析：跨文件组认证传播（同 gin analyzeGinProject） */
+function analyzeFiberProject(projectRoot) {
+    const files = [];
+    const walk = (d) => {
+        for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+            if (e.isDirectory()) {
+                if (["vendor", "node_modules", ".git"].includes(e.name))
+                    continue;
+                walk(`${d}/${e.name}`);
+            }
+            else if (e.name.endsWith(".go") && !e.name.endsWith("_test.go")) {
+                const fp = `${d}/${e.name}`;
+                try {
+                    files.push({ file: fp, text: fs.readFileSync(fp, "utf-8"), a: analyzeFiberFile(fp) });
+                }
+                catch { /* skip */ }
+            }
+        }
+    };
+    if (fs.existsSync(projectRoot))
+        walk(projectRoot.replace(/\/$/, ""));
+    // 多层 Register 链传播（journalist 式 main→api.Register(Group+Use)→…）
+    const protectedFns = fiberProjectProtectedFns(files);
+    const issues = [];
+    for (const { file, text, a } of files) {
+        if (!a || a.issues.length === 0)
+            continue;
+        const pkgM = text.match(/^package\s+(\w+)/m);
+        const filePkg = pkgM ? pkgM[1] : "";
+        for (const issue of a.issues) {
+            const fn = issue.line ? fiberEnclosingFunc(text, issue.line) : null;
+            if (fn && protectedFns.get(`${filePkg}:${fn}`))
+                continue;
+            issues.push({ ...issue });
+        }
+    }
+    return {
+        filesScanned: files.length,
+        protectedFunctions: [...protectedFns.keys()].filter((k) => protectedFns.get(k)),
+        issues,
+    };
+}
+/** 解析一个 Go 文件的顶层函数 */
+function goFuncsOf(text, file) {
+    const out = [];
+    const pkgM = text.match(/^package\s+(\w+)/m);
+    const pkg = pkgM ? pkgM[1] : "";
+    const headerRe = /^func\s+([A-Za-z_]\w*)\s*\(/gm;
+    let m;
+    while ((m = headerRe.exec(text)) !== null) {
+        const hStart = m.index;
+        // 平衡取参数
+        let depth = 1;
+        let end = m.index + m[0].length;
+        while (end < text.length && depth > 0) {
+            if (text[end] === "(")
+                depth++;
+            else if (text[end] === ")")
+                depth--;
+            end++;
+        }
+        const paramsText = text.slice(m.index + m[0].length, end - 1);
+        // 找下一个 func 头作为 body 终点
+        const nxt = out.length ? text.indexOf("func ", end) : text.indexOf("\nfunc ", end);
+        const bodyEnd = (() => {
+            const nextHeader = text.slice(end).search(/^func\s/m);
+            return nextHeader === -1 ? text.length : end + nextHeader;
+        })();
+        const body = text.slice(end, bodyEnd);
+        const routerParams = [];
+        // 参数切分（顶层逗号）
+        let d = 0;
+        let cur = "";
+        const parts = [];
+        for (const ch of paramsText) {
+            if (ch === "(")
+                d++;
+            else if (ch === ")")
+                d--;
+            if (ch === "," && d === 0) {
+                parts.push(cur.trim());
+                cur = "";
+            }
+            else
+                cur += ch;
+        }
+        if (cur.trim())
+            parts.push(cur.trim());
+        for (const p of parts) {
+            // name *pkg.fiber.Router | name fiber.App …
+            const pm = p.match(/^([A-Za-z_]\w*)\s+[\w./*]*(\bfiber\b[\w./]*(?:Router|App|Group))/);
+            if (pm && /Router|App|Group/.test(pm[2]))
+                routerParams.push(pm[1]);
+        }
+        out.push({ file, pkg, name: m[1], routerParams, body: text.slice(end, bodyEnd) });
+        headerRe.lastIndex = bodyEnd; // 跳过函数体
+    }
+    return out;
+}
+/**
+ * 项目级保护函数集（多层 Register 链，包限定键）：
+ * 队列自全部函数「参数未认证」种子起，凡函数体在「组已 Use 认证」后以
+ * 认证组调用项目内 Register 函数 → 该函数入队（参数认证）——支持
+ * journalist 式 main→api.Register(Group+Use)→v1.Register→模块 多层链。
+ * 键 = pkg:name，避免跨包同名函数（feeds.Register/tokens.Register…）串扰。
+ */
+function fiberProjectProtectedFns(files) {
+    const funcs = [];
+    for (const f of files)
+        funcs.push(...goFuncsOf(f.text, f.file));
+    const keyOf = (pkg, name) => `${pkg}:${name}`;
+    const byKey = new Map();
+    for (const fn of funcs) {
+        byKey.set(keyOf(fn.pkg, fn.name), [...(byKey.get(keyOf(fn.pkg, fn.name)) || []), fn]);
+    }
+    const protectedFns = new Map();
+    const done = new Set();
+    const queue = [];
+    for (const fn of funcs)
+        queue.push({ pkg: fn.pkg, name: fn.name, authed: false });
+    while (queue.length) {
+        const { pkg, name, authed } = queue.shift();
+        const dk = `${pkg}|${name}|${authed}`;
+        if (done.has(dk))
+            continue;
+        done.add(dk);
+        if (authed)
+            protectedFns.set(keyOf(pkg, name), true);
+        const candidates = byKey.get(keyOf(pkg, name)) || [];
+        for (const fn of candidates) {
+            const authedParams = new Set();
+            if (authed)
+                fn.routerParams.forEach((pp) => authedParams.add(pp));
+            const callees = fiberBodyProtectedCalls(fn.body, authedParams, funcs);
+            for (const c of callees)
+                queue.push({ pkg: c.pkg, name: c.name, authed: true });
+        }
+    }
+    return protectedFns;
+}
+/**
+ * 函数体内事件模拟 v2：返回在其认证相位被调用的项目函数（包限定）。
+ * 调用限定符 feeds.Register → pkg 匹配 feeds；同包调用按当前函数包。
+ */
+function fiberBodyProtectedCalls(body, authedParams, allFuncs) {
+    const calls = [];
+    const b = body.replace(/\(\s*\*\s*(\w+)\s*\)/g, "$1");
+    const curPkg = allFuncs.find((f) => f.body === body)?.pkg || "";
+    const state = new Map();
+    for (const p of authedParams)
+        state.set(p, true);
+    const re = /(\w+)\s*(?::=|=)\s*(?:[\w.]*\.)?([A-Za-z_]\w*)\.Group\s*\(|(\w+)\.Use\s*\(\s*([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)|(?:([A-Za-z_]\w*)\.)?([A-Z][A-Za-z0-9_]*)\s*\(/g;
+    let m;
+    while ((m = re.exec(b)) !== null) {
+        if (m[1] !== undefined) {
+            state.set(m[1], !!state.get(m[2]));
+        }
+        else if (m[3] !== undefined) {
+            if (isAuthFnName(m[4]))
+                state.set(m[3], true);
+        }
+        else if (m[5] !== undefined || m[6] !== undefined) {
+            const qual = m[5];
+            const fname = m[6];
+            // 项目内函数匹配：限定符 → pkg==qual；无限定符 → 同包
+            const matches = allFuncs.filter((f) => f.name === fname && (qual ? f.pkg === qual : f.pkg === curPkg));
+            if (matches.length === 0)
+                continue;
+            const openIdx = b.indexOf("(", m.index + m[0].length - 1);
+            if (openIdx < 0)
+                continue;
+            let depth = 1;
+            let i = openIdx + 1;
+            while (i < b.length && depth > 0) {
+                if (b[i] === "(")
+                    depth++;
+                else if (b[i] === ")")
+                    depth--;
+                i++;
+            }
+            const args = b.slice(openIdx + 1, i - 1).split(",").map((x) => x.trim().replace(/^[&*]+/, ""));
+            // 实参认证判定：直接组变量 或 内联组派生 X.Group(...)（X 已认证）
+            const argAuthed = (a) => {
+                if (state.get(a))
+                    return true;
+                const g = a.match(/^([A-Za-z_]\w*)\.Group\s*\(/);
+                return !!g && !!state.get(g[1]);
+            };
+            if (args.some(argAuthed)) {
+                for (const mm of matches)
+                    calls.push({ pkg: mm.pkg, name: mm.name });
+            }
+        }
+    }
+    return calls;
+}

package/dist/frameworks/fiber-detector.test.js

@@ -1,10 +1,46 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 /**
  * fiber-detector.test.ts — Fiber 框架适配器规则回归（纯函数，无文件 I/O）
  */
 const vitest_1 = require("vitest");
 const fiber_detector_1 = require("./fiber-detector");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
 const app = (routes, extra = "") => `
 import "github.com/gofiber/fiber/v2"
 
@@ -55,3 +91,155 @@ func main() {
         (0, vitest_1.expect)(issues).toHaveLength(0);
     });
 });
+// ── V8 修复轮回归：窗口边界（单点摘保护不再被后续路由掩盖）──
+(0, vitest_1.describe)("fiber-detector V8 修复回归", () => {
+    (0, vitest_1.it)("窗口不跨路由串扰：下一路由的 Protected 不掩盖上一路由摘保护", () => {
+        const { issues, routes } = (0, fiber_detector_1.analyzeFiberApp)(app(`
+	api.Post("/logout", logoutHandler)
+	api.Post("/refresh-token", middleware.Protected(), refreshHandler)
+`));
+        const logout = routes.find((x) => x.path === "/logout");
+        const refresh = routes.find((x) => x.path === "/refresh-token");
+        (0, vitest_1.expect)(logout.protected).toBe(false);
+        (0, vitest_1.expect)(refresh.protected).toBe(true);
+        (0, vitest_1.expect)(issues.map((i) => i.route)).toContain("POST /logout");
+        (0, vitest_1.expect)(issues.map((i) => i.route)).not.toContain("POST /refresh-token");
+    });
+    (0, vitest_1.it)("handler 名含 auth 词不误判（logoutHandler 不被当认证）", () => {
+        const { routes } = (0, fiber_detector_1.analyzeFiberApp)(app(`
+	api.Post("/logout", authHandler.Logout)
+`));
+        (0, vitest_1.expect)(routes.find((x) => x.path === "/logout").protected).toBe(false);
+    });
+});
+// ── Fiber 组认证跨文件传播（gin 同款模型移植）──
+const FBOOT = `package main
+import "github.com/gofiber/fiber/v2"
+func main() {
+	app := fiber.New()
+	api := app.Group("/api")
+	users.UsersRegister(api.Group("/users"))
+	api.Use(middleware.Protected())
+	users.UserRegister(api.Group("/user"))
+	articles.ArticlesRegister(api.Group("/articles"))
+}
+`;
+const FROUTERS = `package users
+import "github.com/gofiber/fiber/v2"
+func UsersRegister(router fiber.Router) {
+	router.Post("/login", UsersLogin)
+	router.Post("", UsersRegistration)
+}
+func UserRegister(router fiber.Router) {
+	router.Put("", UserUpdate)
+}
+`;
+(0, vitest_1.describe)("fiberProtectedRegisterFns 组认证相位", () => {
+    (0, vitest_1.it)("Use 之后的 Register 受保护，Use 之前的公开", () => {
+        const p = (0, fiber_detector_1.fiberProtectedRegisterFns)(FBOOT);
+        (0, vitest_1.expect)(p.get("UserRegister")).toBe(true);
+        (0, vitest_1.expect)(p.get("ArticlesRegister")).toBe(true);
+        (0, vitest_1.expect)(p.get("UsersRegister")).toBeUndefined();
+    });
+});
+(0, vitest_1.describe)("fiberEnclosingFunc 归属", () => {
+    (0, vitest_1.it)("按 func 头行号归属", () => {
+        // FROUTERS：1 package / 2 import / 3 func UsersRegister / 6 func UserRegister
+        (0, vitest_1.expect)((0, fiber_detector_1.fiberEnclosingFunc)(FROUTERS, 4)).toBe("UsersRegister");
+        (0, vitest_1.expect)((0, fiber_detector_1.fiberEnclosingFunc)(FROUTERS, 7)).toBe("UserRegister");
+    });
+});
+(0, vitest_1.describe)("analyzeFiberProject 跨文件传播", () => {
+    function makeProject(withUse) {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), "fiber-proj-"));
+        const boot = withUse ? FBOOT : FBOOT.replace(/\s*api\.Use\(middleware\.Protected\(\)\)\n/, "");
+        fs.writeFileSync(path.join(dir, "main.go"), boot);
+        fs.writeFileSync(path.join(dir, "routers.go"), FROUTERS);
+        return dir;
+    }
+    (0, vitest_1.it)("Use 保护下跨文件 mutation 不报", () => {
+        const dir = makeProject(true);
+        try {
+            const a = (0, fiber_detector_1.analyzeFiberProject)(dir);
+            (0, vitest_1.expect)(a.issues.filter((i) => i.rule === "FIBER_ROUTE_NO_AUTH")).toHaveLength(0);
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    (0, vitest_1.it)("删 Use → mutation 重现（敏感性保留）", () => {
+        const dir = makeProject(false);
+        try {
+            const a = (0, fiber_detector_1.analyzeFiberProject)(dir);
+            const routes = a.issues.filter((i) => i.rule === "FIBER_ROUTE_NO_AUTH").map((i) => i.route);
+            (0, vitest_1.expect)(routes).toContain("PUT "); // UserRegister mutation 重现
+            // POST "" 是 register（/login 姊妹佐证豁免，公开）——不报正确
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+});
+// ── 多层 Register 链（journalist 式 main→api(Group+Use)→v1→模块）──
+function makeNestedProject(withUse) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "fiber-nest-"));
+    const mk = (rel, content) => {
+        const fp = path.join(dir, rel);
+        fs.mkdirSync(path.dirname(fp), { recursive: true });
+        fs.writeFileSync(fp, content);
+    };
+    mk("main/main.go", `package main
+import "github.com/gofiber/fiber/v2"
+func main() {
+	app := fiber.New()
+	api.Register(app)
+}
+`);
+    mk("api/api.go", `package api
+import "github.com/gofiber/fiber/v2"
+func Register(fiberApp *fiber.App) {
+	api := fiberApp.Group("/api")
+${withUse ? "\tapi.Use(middleware.Protected())\n" : ""}\tv1.Register(&api)
+}
+`);
+    mk("v1/v1.go", `package v1
+import "github.com/gofiber/fiber/v2"
+func Register(router *fiber.Router) {
+	feeds.Register(router)
+}
+`);
+    mk("feeds/feeds.go", `package feeds
+import "github.com/gofiber/fiber/v2"
+func Register(router *fiber.Router) {
+	router.Post("/", CreateFeed)
+	router.Put("/:id", UpdateFeed)
+}
+`);
+    return dir;
+}
+(0, vitest_1.describe)("analyzeFiberProject 多层 Register 链（journalist 式）", () => {
+    (0, vitest_1.it)("api(Group+Use)→v1→feeds 链：跨层 mutation 不报", () => {
+        const dir = makeNestedProject(true);
+        try {
+            const a = (0, fiber_detector_1.analyzeFiberProject)(dir);
+            (0, vitest_1.expect)(a.issues.filter((i) => i.rule === "FIBER_ROUTE_NO_AUTH")).toHaveLength(0);
+            (0, vitest_1.expect)(a.protectedFunctions).toContain("feeds:Register");
+            (0, vitest_1.expect)(a.protectedFunctions).toContain("v1:Register");
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    (0, vitest_1.it)("删中间层 api.Use → feeds mutation 重现（敏感性穿透多层）", () => {
+        const dir = makeNestedProject(false);
+        try {
+            const a = (0, fiber_detector_1.analyzeFiberProject)(dir);
+            const routes = a.issues.filter((i) => i.rule === "FIBER_ROUTE_NO_AUTH").map((i) => i.route);
+            (0, vitest_1.expect)(routes).toContain("POST /");
+            (0, vitest_1.expect)(routes).toContain("PUT /:id");
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+});