progmune-runtime 3.7.14 → 3.7.16

package/dist/frameworks/koa-detector.js

@@ -55,6 +55,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.analyzeKoaApp = analyzeKoaApp;
 exports.analyzeKoaFile = analyzeKoaFile;
 const fs = __importStar(require("fs"));
+const route_window_1 = require("./route-window");
 const MUTATION_METHODS = new Set(["post", "put", "patch", "delete", "del"]);
 const AUTH_ENTRY_WORDS = [
     "login", "signin", "sign_in", "regist", "signup", "sign_up",
@@ -89,14 +90,18 @@ function analyzeKoaApp(code) {
             authGlobalMiddleware.push(m[1]);
     }
     // 路由注册：router.post('/x', mw1, mw2, handler) / .del()
-    const routeRe = /\.(get|post|put|patch|delete|del)\s*\(\s*['"]([^'"]+)['"]/g;
+    // 接收者限定 router/*Router/app——config.get('secret') 之类不再被当路由
+    const routeRe = /\b(?:router|[A-Za-z_$][\w$]*[Rr]outer|app)\s*\.(get|post|put|patch|delete|del)\s*\(\s*['"]([^'"]+)['"]/g;
     while ((m = routeRe.exec(code)) !== null) {
         const method = m[1].toLowerCase() === "del" ? "delete" : m[1].toLowerCase();
         const pathName = m[2];
-        // 从路径串向后截 300 字符窗口，收集中间件名（认证名判定）
-        const windowStart = m.index + m[0].length;
-        const window = code.slice(windowStart, windowStart + 300);
-        const mwNames = window.match(/[A-Za-z_$][\w$]*/g) || [];
+        // 认证名收集窗口 = 本次路由调用（自路径串后至本调用闭合括号），
+        // 不跨路由边界——修复 300 字符前向窗口跨路由串扰（bleed）缺陷：
+        // 后面路由的 auth 名不再把前面的公开路由洗成 protected
+        const window = (0, route_window_1.routeCallWindow)(code, m.index + m[0].length);
+        // koa-router 语义：(path, ...middleware, handler)——末参 handler 由
+        // middlewareNamesFromWindow 排除，handler 名（如 ctrl.login）不再误判
+        const mwNames = (0, route_window_1.middlewareNamesFromWindow)(window);
         const hasAuthMw = mwNames.some((name) => isAuthFnName(name));
         routes.push({
             method,
@@ -104,15 +109,25 @@ function analyzeKoaApp(code) {
             protected: hasAuthMw,
             line: code.slice(0, m.index).split("\n").length,
         });
-        if (MUTATION_METHODS.has(method) && !hasAuthMw
-            && authGlobalMiddleware.length === 0 && !isAuthEntryPath(pathName)) {
+    }
+    // register 集合豁免（语义层）：同文件存在 <path>/login|register|signup…
+    // 姊妹路由 ⇒ <path> 是账户集合，其无认证 POST = 公开注册（realworld
+    // 惯用 POST /users 而非 /register——路径豁免词表认不出，Koa 语料
+    // 1/1 register FP 的根因）。有 login 佐证才豁免：管理员建用户类
+    // 端点（无姊妹 login）仍会报
+    const registerRoots = (0, route_window_1.collectRegisterRoots)(routes.map((r) => r.path));
+    for (const r of routes) {
+        if (MUTATION_METHODS.has(r.method) && !r.protected
+            && authGlobalMiddleware.length === 0
+            && !isAuthEntryPath(r.path)
+            && !(r.method === "post" && (0, route_window_1.isRegisterRoot)(r.path, registerRoots))) {
             issues.push({
                 severity: "medium",
                 rule: "KOA_ROUTE_NO_AUTH",
-                message: `Route ${method.toUpperCase()} ${pathName} has no auth middleware ` +
+                message: `Route ${r.method.toUpperCase()} ${r.path} has no auth middleware ` +
                     `and the app registers no auth middleware — any caller can reach it.`,
-                route: `${method.toUpperCase()} ${pathName}`,
-                line: code.slice(0, m.index).split("\n").length,
+                route: `${r.method.toUpperCase()} ${r.path}`,
+                line: r.line,
             });
         }
     }

package/dist/frameworks/koa-detector.test.js

@@ -54,4 +54,42 @@ router.post("/login", async (ctx) => { ctx.body = "token"; });
         (0, vitest_1.expect)(hasKoa).toBe(false);
         (0, vitest_1.expect)(issues).toHaveLength(0);
     });
+    (0, vitest_1.it)("回归：窗口不跨路由串扰——公开路由后面的 auth 路由不再把它洗成 protected（修复 300 字符 bleed）", () => {
+        const { issues, routes } = (0, koa_detector_1.analyzeKoaApp)(app(`
+router.post("/users", ctrl.post);            // 公开 register —— 应报
+router.post("/articles", auth, ctrl.create); // 受保护 —— 不报
+`));
+        const register = routes.find((r) => r.path === "/users");
+        const article = routes.find((r) => r.path === "/articles");
+        (0, vitest_1.expect)(register.protected).toBe(false);
+        (0, vitest_1.expect)(article.protected).toBe(true);
+        (0, vitest_1.expect)(issues.map((i) => i.route)).toContain("POST /users");
+        (0, vitest_1.expect)(issues.map((i) => i.route)).not.toContain("POST /articles");
+    });
+    (0, vitest_1.it)("回归：config.get('secret') 不再是幻影路由（接收者限定 router/app）", () => {
+        const { routes } = (0, koa_detector_1.analyzeKoaApp)(app(`
+const secret = config.get("secret");
+router.post("/x", auth, h);
+`));
+        (0, vitest_1.expect)(routes.map((r) => r.path)).not.toContain("secret");
+        (0, vitest_1.expect)(routes.map((r) => r.path)).toContain("/x");
+    });
+});
+(0, vitest_1.describe)("koa-detector register 集合豁免（语义层）", () => {
+    (0, vitest_1.it)("有 /users/login 姊妹佐证：POST /users（公开注册）不报", () => {
+        const { issues } = (0, koa_detector_1.analyzeKoaApp)(app(`
+router.post("/users/login", ctrl.login);
+router.post("/users", ctrl.register);
+router.post("/articles", auth, ctrl.create);
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.route)).not.toContain("POST /users");
+        (0, vitest_1.expect)(issues.map((i) => i.route)).not.toContain("POST /users/login");
+        (0, vitest_1.expect)(issues.map((i) => i.route)).not.toContain("POST /articles");
+    });
+    (0, vitest_1.it)("无姊妹佐证：POST /users 仍报（管理员建用户类端点不豁免）", () => {
+        const { issues } = (0, koa_detector_1.analyzeKoaApp)(app(`
+router.post("/users", ctrl.createUser);
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.route)).toContain("POST /users");
+    });
 });

package/dist/frameworks/nestjs-detector.js

@@ -20,6 +20,7 @@ exports.analyzeNestJSProject = analyzeNestJSProject;
 exports.analyzeNestJSFile = analyzeNestJSFile;
 exports.formatNestJSReport = formatNestJSReport;
 const ts_morph_1 = require("ts-morph");
+const route_window_1 = require("./route-window");
 // ── Core Analysis ──
 function analyzeNestJSProject(projectRoot) {
     let project;
@@ -64,6 +65,60 @@ function analyzeNestJSProject(projectRoot) {
         }
     }
     const hasGlobalAuthGuard = analysis.globalAuthGuards.length > 0;
+    // ── 第二遍：模块级中间件保护（Nest 5 时代惯用法）──
+    // class XxxModule implements NestModule { configure(consumer) {
+    //   consumer.apply(AuthMiddleware).forRoutes({path, method}, ...) } }
+    // 覆盖关系：controller → [{path, methods}]（REALWORLD_STRUCTURAL_V1：
+    // guard 单一模型漏掉 configure/forRoutes 中间件保护 → 23 issues 全 FP）
+    const ctrlMiddleware = new Map();
+    for (const file of project.getSourceFiles()) {
+        if (file.getFilePath().includes("node_modules"))
+            continue;
+        for (const cls of file.getClasses()) {
+            const moduleDec = cls.getDecorator("Module");
+            if (!moduleDec)
+                continue;
+            const configure = cls.getMethods().find((mm) => mm.getName() === "configure");
+            if (!configure)
+                continue;
+            const coverage = extractMiddlewareForRoutes(configure.getText());
+            if (coverage.length === 0)
+                continue;
+            // 该模块声明管哪些 controller
+            const ctrlNames = extractModuleControllerNames(moduleDec);
+            for (const c of ctrlNames) {
+                const merged = ctrlMiddleware.get(c) || [];
+                merged.push(...coverage);
+                ctrlMiddleware.set(c, merged);
+            }
+        }
+    }
+    // ── register 集合豁免预扫（语义层）──
+    // 项目级收集账户入口路由（*\/login|register|signup…）→ 集合根
+    // （/users/login → /users）；该集合的 POST = 公开注册（realworld 惯用
+    // POST /users——register FP 跨框架根因）。POST-only：同集合的 PUT 等
+    // 不豁免；无 login 姊妹佐证的写集合（管理员建用户）仍查
+    const allRoutePaths = [];
+    for (const file of project.getSourceFiles()) {
+        if (file.getFilePath().includes("node_modules"))
+            continue;
+        if (/\.(test|spec)\.ts$/.test(file.getFilePath()))
+            continue;
+        for (const cls of file.getClasses()) {
+            const ctrlDec = cls.getDecorator("Controller");
+            if (!ctrlDec)
+                continue;
+            const basePath = getStringArg(ctrlDec, 0) || "";
+            for (const method of cls.getMethods()) {
+                const http = getHttpMethod(method);
+                if (!http)
+                    continue;
+                const routePath = getStringArg(method.getDecorators().find((d) => isHttpDecorator(d)), 0) || "";
+                allRoutePaths.push(basePath + (routePath.startsWith("/") ? routePath : `/${routePath}`));
+            }
+        }
+    }
+    const registerRoots = (0, route_window_1.collectRegisterRoots)(allRoutePaths);
     for (const file of project.getSourceFiles()) {
         // Skip node_modules and test files
         if (file.getFilePath().includes("node_modules"))
@@ -111,13 +166,16 @@ function analyzeNestJSProject(projectRoot) {
                     isPublicDecorated,
                 };
                 analysis.routes.push(route);
-                // 路由级保护判定：类/方法认证守卫，或全局 APP_GUARD（除非 @Public 豁免）
+                // 路由级保护判定：类/方法认证守卫，或全局 APP_GUARD（除非 @Public 豁免），
+                // 或模块级中间件 forRoutes 覆盖（Nest 5 惯用法）
                 const protectedByGlobal = hasGlobalAuthGuard && !isPublicDecorated;
+                const protectedByMiddleware = middlewareCovers(ctrlMiddleware, controllerName, httpMethod, fullPath);
                 // ── Security Checks ──
                 // POST/PUT/DELETE without auth guard
                 // Skip intentionally public routes (login, register, health, etc.)
                 if (["POST", "PUT", "DELETE", "PATCH"].includes(httpMethod) && !isPublicRoute(fullPath)) {
-                    if (!route.hasAuthGuard && !protectedByGlobal) {
+                    const isRegisterPost = httpMethod === "POST" && (0, route_window_1.isRegisterRoot)(fullPath, registerRoots);
+                    if (!route.hasAuthGuard && !protectedByGlobal && !protectedByMiddleware && !isRegisterPost) {
                         analysis.issues.push({
                             type: "NESTJS_NO_AUTH",
                             severity: "critical",
@@ -145,7 +203,7 @@ function analyzeNestJSProject(projectRoot) {
                 if (httpMethod === "GET") {
                     const sensitiveTerms = ["admin", "private", "secret", "manage"];
                     if (sensitiveTerms.some(t => fullPath.toLowerCase().includes(t))
-                        && !route.hasAuthGuard && !protectedByGlobal) {
+                        && !route.hasAuthGuard && !protectedByGlobal && !protectedByMiddleware) {
                         analysis.issues.push({
                             type: "NESTJS_SENSITIVE_PUBLIC",
                             severity: "high",
@@ -216,6 +274,90 @@ function extractAppGuardNames(moduleDec, cls) {
     }
     return names;
 }
+// ── 模块级中间件覆盖（Nest 5 configure/forRoutes 惯用法）──
+/** 从 configure(consumer) 方法文本提取 forRoutes 覆盖：{path, methods[]} */
+function extractMiddlewareForRoutes(configureText) {
+    const out = [];
+    // consumer.apply(X).forRoutes({...}, {...}) / .forRoutes('path', ...)
+    const frIndexes = [];
+    let idx = 0;
+    while ((idx = configureText.indexOf(".forRoutes(", idx)) !== -1) {
+        frIndexes.push(idx + ".forRoutes(".length);
+        idx += ".forRoutes(".length;
+    }
+    for (const start of frIndexes) {
+        // 括号平衡取 forRoutes 参数块
+        let depth = 1;
+        let end = start;
+        while (end < configureText.length && depth > 0) {
+            if (configureText[end] === "(")
+                depth++;
+            else if (configureText[end] === ")")
+                depth--;
+            end++;
+        }
+        const argsText = configureText.slice(start, end - 1);
+        // 逐顶层参数（逗号切分，深度感知）
+        const args = [];
+        let cur = "";
+        let d = 0;
+        for (const ch of argsText) {
+            if (ch === "(" || ch === "[" || ch === "{")
+                d++;
+            else if (ch === ")" || ch === "]" || ch === "}")
+                d--;
+            if (ch === "," && d === 0) {
+                args.push(cur);
+                cur = "";
+            }
+            else
+                cur += ch;
+        }
+        if (cur.trim())
+            args.push(cur);
+        for (const arg of args) {
+            const trimmed = arg.trim();
+            const pathM = trimmed.match(/path\s*:\s*['"]([^'"]+)['"]/);
+            const methodM = trimmed.match(/method\s*:\s*RequestMethod\.(\w+)/);
+            const plain = trimmed.match(/^['"]([^'"]+)['"]$/);
+            const path = pathM ? pathM[1] : plain ? plain[1] : null;
+            if (!path)
+                continue;
+            const method = methodM ? methodM[1] : "*";
+            out.push({ path, methods: [method] });
+        }
+    }
+    return out;
+}
+/** @Module({ controllers: [A, B] }) 里的控制器类名 */
+function extractModuleControllerNames(moduleDec) {
+    const out = [];
+    const text = moduleDec.getText();
+    const m = text.match(/controllers\s*:\s*\[([^\]]*)\]/);
+    if (!m)
+        return out;
+    for (const name of m[1].split(",")) {
+        const n = name.trim().replace(/\s+as\s+\w+$/, "").split(".").pop();
+        if (n && /^[A-Za-z_$]/.test(n))
+            out.push(n);
+    }
+    return out;
+}
+/** route（method, fullPath）是否被 controller 的模块中间件覆盖 */
+function middlewareCovers(ctrlMiddleware, controllerName, httpMethod, fullPath) {
+    const entries = ctrlMiddleware.get(controllerName);
+    if (!entries || entries.length === 0)
+        return false;
+    const norm = (p) => p.replace(/^\/+|\/+$/g, "");
+    const routePath = norm(fullPath);
+    return entries.some((e) => {
+        const em = e.methods[0] || "*";
+        // RequestMethod.ALL 与通配 * 匹配任意方法
+        if (em !== "*" && em !== "ALL" && em !== httpMethod)
+            return false;
+        return norm(e.path) === routePath;
+    });
+}
 /** Check if a route is intentionally public (login, register, health, etc.). */
 function isPublicRoute(path) {
     // Normalize: ensure leading slash for consistent matching

package/dist/frameworks/nestjs-detector.test.js

@@ -138,3 +138,106 @@ export class AppModule {}
         (0, vitest_1.expect)(issues.map((i) => i.type)).not.toContain("NESTJS_NO_AUTH");
     });
 });
+(0, vitest_1.describe)("nestjs-detector 模块中间件覆盖（V1 修复回归）", () => {
+    (0, vitest_1.it)("NestModule configure/forRoutes 保护的 mutation 不报（Nest 5 惯用法）", () => {
+        write("tsconfig.json", TSCONFIG);
+        write("src/app.module.ts", `
+import { Module, NestModule, MiddlewareConsumer, RequestMethod } from "@nestjs/common";
+import { AuthMiddleware } from "./auth.middleware";
+import { ApiController } from "./api.controller";
+
+@Module({ controllers: [ApiController] })
+export class AppModule implements NestModule {
+  configure(consumer: MiddlewareConsumer) {
+    consumer
+      .apply(AuthMiddleware)
+      .forRoutes(
+        { path: "api/transfer", method: RequestMethod.POST },
+        { path: "api/items/:id", method: RequestMethod.ALL },
+      );
+  }
+}
+`);
+        write("src/api.controller.ts", `
+import { Controller, Post, Delete, Get } from "@nestjs/common";
+@Controller("api")
+export class ApiController {
+  @Post("transfer") transfer() { return {}; }
+  @Delete("items/:id") deleteItem() { return {}; }
+  @Post("public") publicCreate() { return {}; }
+}
+`);
+        write("src/auth.middleware.ts", `
+import { NestMiddleware } from "@nestjs/common";
+export class AuthMiddleware implements NestMiddleware { use() {} }
+`);
+        const a = (0, nestjs_detector_1.analyzeNestJSProject)(dir);
+        const noAuth = a.issues.filter((i) => i.type === "NESTJS_NO_AUTH");
+        // transfer 与 items/:id 受 forRoutes 中间件保护 → 不报
+        (0, vitest_1.expect)(noAuth.map((i) => i.route)).not.toContain("POST api/transfer");
+        (0, vitest_1.expect)(noAuth.map((i) => i.route)).not.toContain("DELETE api/items/:id");
+        // 未覆盖的 public 写路由仍报（保留敏感性）
+        (0, vitest_1.expect)(noAuth.map((i) => i.route)).toContain("POST api/public");
+    });
+    (0, vitest_1.it)("摘除 forRoutes 中间件覆盖后 mutation 重新被报（无感修复回归）", () => {
+        write("tsconfig.json", TSCONFIG);
+        write("src/app.module.ts", `
+import { Module, NestModule, MiddlewareConsumer, RequestMethod } from "@nestjs/common";
+import { ApiController } from "./api.controller";
+@Module({ controllers: [ApiController] })
+export class AppModule implements NestModule {
+  configure(consumer: MiddlewareConsumer) {
+    consumer.apply(AuthMiddleware).forRoutes(); // 覆盖被摘空
+  }
+}
+`);
+        write("src/api.controller.ts", `
+import { Controller, Post } from "@nestjs/common";
+@Controller("api")
+export class ApiController {
+  @Post("transfer") transfer() { return {}; }
+}
+`);
+        write("src/auth.middleware.ts", `
+import { NestMiddleware } from "@nestjs/common";
+export class AuthMiddleware implements NestMiddleware { use() {} }
+`);
+        const a = (0, nestjs_detector_1.analyzeNestJSProject)(dir);
+        (0, vitest_1.expect)(a.issues.some((i) => i.type === "NESTJS_NO_AUTH" && i.route === "POST api/transfer")).toBe(true);
+    });
+});
+(0, vitest_1.describe)("nestjs-detector register 集合豁免（语义层）", () => {
+    function writeUserApp() {
+        write("tsconfig.json", TSCONFIG);
+        write("src/user.controller.ts", `
+import { Controller, Post, Get, Delete } from "@nestjs/common";
+@Controller()
+export class UserController {
+  @Post("users/login") login() { return {}; }
+  @Post("users") register() { return {}; }            // 公开注册
+  @Delete("users/:slug") deleteUser() { return {}; }  // 真实无保护
+}
+`);
+    }
+    (0, vitest_1.it)("有 users/login 姊妹佐证：POST users（公开注册）不报", () => {
+        writeUserApp();
+        const a = (0, nestjs_detector_1.analyzeNestJSProject)(dir);
+        const noAuth = a.issues.filter((i) => i.type === "NESTJS_NO_AUTH");
+        (0, vitest_1.expect)(noAuth.map((i) => i.route)).not.toContain("POST /users");
+        (0, vitest_1.expect)(noAuth.map((i) => i.route)).not.toContain("POST /users/login");
+        // 真实无保护的 DELETE 仍报（豁免不误伤）
+        (0, vitest_1.expect)(noAuth.map((i) => i.route)).toContain("DELETE /users/:slug");
+    });
+    (0, vitest_1.it)("无姊妹佐证：POST users 仍报（管理员建用户不豁免）", () => {
+        write("tsconfig.json", TSCONFIG);
+        write("src/admin.controller.ts", `
+import { Controller, Post } from "@nestjs/common";
+@Controller()
+export class AdminController {
+  @Post("users") adminCreateUser() { return {}; }
+}
+`);
+        const a = (0, nestjs_detector_1.analyzeNestJSProject)(dir);
+        (0, vitest_1.expect)(a.issues.some((i) => i.type === "NESTJS_NO_AUTH" && i.route === "POST /users")).toBe(true);
+    });
+});

package/dist/frameworks/nextjs-detector.js

@@ -66,7 +66,10 @@ const AUTH_ENTRY_WORDS = [
     "login", "signin", "sign_in", "regist", "signup", "sign_up",
     "token", "auth", "health",
 ];
-const AUTH_CALL_RE = /\b(getServerSession|requireAuth|requireUser|verifyToken|verifyAuth|isAuthenticated|checkAuth|getToken|withAuth|authSession|authenticate)\s*\(/;
+// 路由级认证信号：会话式（getServerSession/next-auth v5 auth()/clerk
+// currentUser）+ webhook 载荷签名校验（Stripe constructEvent 等——
+// V5 真实语料证明 webhook 端点的标准保护是签名校验而非会话）
+const AUTH_CALL_RE = /\b(getServerSession|requireAuth|requireUser|verifyToken|verifyAuth|isAuthenticated|checkAuth|getToken|withAuth|authSession|authenticate|auth|currentUser)\s*\(|\b(constructEvent|verifyWebhook|verifySignature|verifyWebhookSignature|validateWebhook|validateSignature)\s*\(/;
 const AUTH_MIDDLEWARE_RE = /\b(getServerSession|requireAuth|verifyToken|getToken|withAuth|next-auth|authorization|authenticate)\b/;
 function isAuthEntryFile(relFile) {
     const lower = relFile.toLowerCase();

package/dist/frameworks/nextjs-detector.test.js

@@ -110,4 +110,39 @@ export default withAuth(function middleware(req) {});
         (0, vitest_1.expect)(hasNext).toBe(false);
         (0, vitest_1.expect)(issues).toHaveLength(0);
     });
+    (0, vitest_1.it)("V5 修复回归：Stripe webhook 签名校验（constructEvent）视为端点认证——不报", () => {
+        writeRoute("app/api/webhooks/stripe/route.ts", `
+import { stripe } from "@/lib/stripe";
+export async function POST(req: Request) {
+  const body = await req.text();
+  const signature = req.headers.get("stripe-signature") as string;
+  const event = stripe.webhooks.constructEvent(body, signature, process.env.SECRET!);
+  return Response.json({ received: true });
+}
+`);
+        const { issues } = (0, nextjs_detector_1.analyzeNextApp)(dir);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("V5 修复回归：webhook 无签名校验仍报（保留对真缺失认证的敏感性）", () => {
+        writeRoute("app/api/webhooks/stripe/route.ts", `
+export async function POST(req: Request) {
+  const body = await req.text();
+  return Response.json({ received: true });
+}
+`);
+        const { issues } = (0, nextjs_detector_1.analyzeNextApp)(dir);
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("NEXT_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("V5 修复回归：next-auth v5 / clerk 裸 auth() 调用视为认证——不报", () => {
+        writeRoute("app/api/transfer/route.ts", `
+import { auth } from "@/auth";
+export async function POST(req: Request) {
+  const session = await auth();
+  if (!session?.user) return new Response(null, { status: 403 });
+  return Response.json({ ok: true });
+}
+`);
+        const { issues } = (0, nextjs_detector_1.analyzeNextApp)(dir);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
 });

package/dist/frameworks/route-window.js

@@ -0,0 +1,124 @@
+"use strict";
+/**
+ * route-window.ts — 路由调用窗口共享工具（Koa/Gin/Fiber 代码串检测器共用）
+ *
+ * 背景：初代实现用「路径串后固定 300 字符窗口」收集认证中间件名 →
+ * 跨路由串扰（bleed）：后面路由的 auth 名污染前面公开路由的保护判定
+ * （V3 Koa / V7 Gin / V8 Fiber 同款缺陷）。
+ *
+ * 修复思路：
+ *  1. routeCallWindow —— 窗口 = 本次路由调用边界内（括号深度感知到闭合
+ *     `)`），不跨路由、容忍内联 handler 的多层括号
+ *  2. middlewareNamesFromWindow —— koa-router/gin/fiber 语义一致：
+ *     `(path, ...middleware, handler)`，最后一个纯函数引用参数是
+ *     handler（如 ctrl.login / UsersLogin），排除——handler 名含 auth
+ *     词不再被误判为认证中间件
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.routeCallWindow = routeCallWindow;
+exports.middlewareNamesFromWindow = middlewareNamesFromWindow;
+exports.normPath = normPath;
+exports.collectRegisterRoots = collectRegisterRoots;
+exports.isRegisterRoot = isRegisterRoot;
+/**
+ * 自路由调用起点（路径串刚结束处）扫描到本次调用的闭合括号。
+ * @param code  源码
+ * @param from  路径串结束位置（调用括号深度已为 1——方法名的 `(` 已消费）
+ * @returns 窗口内容（含闭合 `)`）
+ */
+function routeCallWindow(code, from) {
+    let depth = 1;
+    let end = from;
+    let quote = null;
+    const MAX = 4000;
+    while (end < code.length && end - from < MAX) {
+        const ch = code[end];
+        if (quote) {
+            if (ch === quote && code[end - 1] !== "\\")
+                quote = null;
+        }
+        else if (ch === '"' || ch === "'" || ch === "`") {
+            quote = ch;
+        }
+        else if (ch === "(") {
+            depth++;
+        }
+        else if (ch === ")") {
+            depth--;
+            if (depth === 0)
+                break;
+        }
+        end++;
+    }
+    return code.slice(from, end + 1);
+}
+/** 纯函数引用：auth / ctrl.login / users.AuthMiddleware */
+function isPlainFnRef(s) {
+    return /^[A-Za-z_$][\w$]*(\.[A-Za-z_$][\w$]*)*$/.test(s.trim());
+}
+/**
+ * 从路由调用参数窗口提取中间件候选名。
+ * 顶层逗号切分（深度感知）→ 末参若为纯函数引用则视为 handler 排除 →
+ * 其余参数内的标识符即中间件候选。
+ */
+function middlewareNamesFromWindow(window) {
+    const names = [];
+    const body = window.replace(/\)\s*$/, "");
+    const parts = [];
+    let cur = "";
+    let d = 0;
+    for (const ch of body) {
+        if (ch === "(" || ch === "[" || ch === "{")
+            d++;
+        else if (ch === ")" || ch === "]" || ch === "}")
+            d--;
+        if (ch === "," && d === 0) {
+            parts.push(cur);
+            cur = "";
+        }
+        else {
+            cur += ch;
+        }
+    }
+    if (cur.trim().length > 0)
+        parts.push(cur);
+    const mwParts = isPlainFnRef(parts[parts.length - 1] ?? "")
+        ? parts.slice(0, -1)
+        : parts;
+    for (const p of mwParts) {
+        const found = p.match(/[A-Za-z_$][\w$]*/g) || [];
+        names.push(...found);
+    }
+    return names;
+}
+// ── register 集合豁免（语义层，Koa/Gin/Fiber/NestJS 共用）──
+/** 账户集合根判定词：路径以这些后缀结尾的路由是账户入口（login 等） */
+const ACCOUNT_ENTRY_SUFFIXES = [
+    "/login", "/signin", "/sign_in", "/register", "/signup", "/sign_up",
+];
+/** 规范化路径：去首尾斜杠 */
+function normPath(p) {
+    return p.replace(/^\/+|\/+$/g, "");
+}
+/**
+ * 收集「账户集合根」：对每条路径，若以账户入口后缀结尾（如 /users/login），
+ * 剥掉后缀得集合根（/users）。该集合的无认证 POST = 公开注册（豁免）。
+ * 佐证式豁免——无 login/register 姊妹的写集合不豁免（管理员建用户等仍查）。
+ */
+function collectRegisterRoots(paths) {
+    const roots = new Set();
+    for (const p of paths) {
+        const lower = p.toLowerCase();
+        for (const suffix of ACCOUNT_ENTRY_SUFFIXES) {
+            if (lower.endsWith(suffix)) {
+                roots.add(normPath(p.slice(0, -suffix.length)));
+                break;
+            }
+        }
+    }
+    return roots;
+}
+/** routePath 是否命中账户集合根（规范化比较） */
+function isRegisterRoot(routePath, roots) {
+    return roots.has(normPath(routePath));
+}