pumuki 6.3.293 → 6.3.295

package/core/facts/detectors/typescript/index.test.ts

@@ -6,14 +6,27 @@ import {
   findDtoPropertyWithoutValidationMatch,
   findDtoNestedPropertyWithoutNestedValidationMatch,
   findBackendControllerRouteWithoutGuardLines,
+  findBackendControllerRouteWithoutRolesLines,
+  findBackendEventHandlerWithoutOnEventLines,
+  findBackendAuthRouteWithoutThrottleLines,
   findBackendPermissiveCorsConfigurationLines,
   findBackendStringLiteralUnionEnumCandidateLines,
+  findBackendSensitiveCacheWriteLines,
   findBackendHardDeleteWithoutSoftDeleteLines,
   findBackendLogWithoutContextLines,
+  findBackendAuthResponseWithoutRefreshTokenLines,
+  findBackendProcessEnvDefaultFallbackLines,
+  findBackendDirectProcessEnvReadLines,
+  findBackendConfigModuleWithoutValidationLines,
   findBackendInconsistentErrorResponseLines,
   findBackendErrorPayloadWithSuccessStatusLines,
   findBackendControllerEntityResponseLines,
+  findBackendControllerBusinessLogicMatch,
+  findBackendRepositoryBusinessLogicMatch,
   findBackendRawThrowExpressionLines,
+  findBackendMissingGlobalValidationPipeLines,
+  findBackendMissingHelmetSecurityHeadersLines,
+  findBackendMissingCompressionMiddlewareLines,
   findFrameworkDependencyImportMatch,
   findMixedCommandQueryClassMatch,
   findMixedCommandQueryInterfaceMatch,
@@ -22,6 +35,7 @@ import {
   findNetworkCallWithoutErrorHandlingLines,
   findNestJsConstructorDependencyWithoutDecoratorMatch,
   findPersistenceMutationWithoutAuditEventMatch,
+  findDtoPropertyWithoutApiPropertyLines,
   findRecordStringUnknownTypeLines,
   findUndefinedInBaseTypeUnionLines,
   findUnknownWithoutGuardLines,
@@ -35,15 +49,25 @@ import {
   hasDefaultExportedApiRouteHandler,
   hasDirectNetworkCall,
   hasDtoPropertyWithoutValidation,
+  hasDtoPropertyWithoutApiProperty,
   hasDtoNestedPropertyWithoutNestedValidation,
   hasBackendControllerRouteWithoutGuard,
+  hasBackendControllerRouteWithoutRoles,
+  hasBackendEventHandlerWithoutOnEvent,
+  hasBackendAuthRouteWithoutThrottle,
   hasBackendPermissiveCorsConfiguration,
   hasBackendStringLiteralUnionEnumCandidate,
+  hasBackendSensitiveCacheWrite,
   hasBackendHardDeleteWithoutSoftDelete,
   hasBackendInconsistentErrorResponse,
   hasBackendErrorPayloadWithSuccessStatus,
   hasBackendControllerEntityResponse,
+  hasBackendControllerBusinessLogic,
+  hasBackendRepositoryBusinessLogic,
   hasBackendRawThrowExpression,
+  hasBackendMissingGlobalValidationPipe,
+  hasBackendMissingHelmetSecurityHeaders,
+  hasBackendMissingCompressionMiddleware,
   hasEmptyCatchClause,
   hasEvalCall,
   hasExplicitAnyType,
@@ -54,6 +78,10 @@ import {
   hasNestedIfElseStatement,
   hasNestJsConstructorDependencyWithoutDecorator,
   hasBackendLogWithoutContext,
+  hasBackendAuthResponseWithoutRefreshToken,
+  hasBackendProcessEnvDefaultFallback,
+  hasBackendDirectProcessEnvRead,
+  hasBackendConfigModuleWithoutValidation,
   hasBackendMagicNumberLiteral,
   hasBackendGenericErrorThrow,
   hasBackendProductionMockOrSpy,
@@ -307,6 +335,237 @@ test('hasBackendLogWithoutContext detecta logs backend sin request user o trace
   assert.equal(hasBackendLogWithoutContext(contextualLoggerAst), false);
 });
 
+test('hasBackendAuthResponseWithoutRefreshToken detecta respuestas auth solo con access token', () => {
+  const accessOnlyResponseAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ReturnStatement',
+        argument: {
+          type: 'ObjectExpression',
+          loc: { start: { line: 16 }, end: { line: 19 } },
+          properties: [
+            {
+              type: 'ObjectProperty',
+              key: { type: 'Identifier', name: 'accessToken' },
+              value: { type: 'Identifier', name: 'accessToken' },
+            },
+          ],
+        },
+      },
+    ],
+  };
+  const refreshTokenResponseAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ReturnStatement',
+        argument: {
+          type: 'ObjectExpression',
+          loc: { start: { line: 27 }, end: { line: 31 } },
+          properties: [
+            {
+              type: 'ObjectProperty',
+              key: { type: 'Identifier', name: 'accessToken' },
+              value: { type: 'Identifier', name: 'accessToken' },
+            },
+            {
+              type: 'ObjectProperty',
+              key: { type: 'Identifier', name: 'refreshToken' },
+              value: { type: 'Identifier', name: 'refreshToken' },
+            },
+          ],
+        },
+      },
+    ],
+  };
+
+  assert.equal(hasBackendAuthResponseWithoutRefreshToken(accessOnlyResponseAst), true);
+  assert.deepEqual(findBackendAuthResponseWithoutRefreshTokenLines(accessOnlyResponseAst), [16]);
+  assert.equal(hasBackendAuthResponseWithoutRefreshToken(refreshTokenResponseAst), false);
+});
+
+test('hasBackendProcessEnvDefaultFallback detecta defaults literales en process.env', () => {
+  const envFallbackAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'VariableDeclaration',
+        declarations: [
+          {
+            type: 'VariableDeclarator',
+            id: { type: 'Identifier', name: 'jwtSecret' },
+            init: {
+              type: 'LogicalExpression',
+              operator: '||',
+              loc: { start: { line: 6 }, end: { line: 6 } },
+              left: {
+                type: 'MemberExpression',
+                object: {
+                  type: 'MemberExpression',
+                  object: { type: 'Identifier', name: 'process' },
+                  property: { type: 'Identifier', name: 'env' },
+                },
+                property: { type: 'Identifier', name: 'JWT_SECRET' },
+              },
+              right: { type: 'StringLiteral', value: 'dev-secret' },
+            },
+          },
+          {
+            type: 'VariableDeclarator',
+            id: { type: 'Identifier', name: 'port' },
+            init: {
+              type: 'LogicalExpression',
+              operator: '??',
+              loc: { start: { line: 9 }, end: { line: 9 } },
+              left: {
+                type: 'MemberExpression',
+                object: {
+                  type: 'MemberExpression',
+                  object: { type: 'Identifier', name: 'process' },
+                  property: { type: 'Identifier', name: 'env' },
+                },
+                property: { type: 'Identifier', name: 'PORT' },
+              },
+              right: { type: 'NumericLiteral', value: 3000 },
+            },
+          },
+        ],
+      },
+    ],
+  };
+  const strictEnvAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'VariableDeclaration',
+        declarations: [
+          {
+            type: 'VariableDeclarator',
+            id: { type: 'Identifier', name: 'jwtSecret' },
+            init: {
+              type: 'CallExpression',
+              callee: { type: 'Identifier', name: 'requiredEnv' },
+              arguments: [
+                {
+                  type: 'MemberExpression',
+                  object: {
+                    type: 'MemberExpression',
+                    object: { type: 'Identifier', name: 'process' },
+                    property: { type: 'Identifier', name: 'env' },
+                  },
+                  property: { type: 'Identifier', name: 'JWT_SECRET' },
+                },
+              ],
+            },
+          },
+        ],
+      },
+    ],
+  };
+
+  assert.equal(hasBackendProcessEnvDefaultFallback(envFallbackAst), true);
+  assert.deepEqual(findBackendProcessEnvDefaultFallbackLines(envFallbackAst), [6, 9]);
+  assert.equal(hasBackendProcessEnvDefaultFallback(strictEnvAst), false);
+});
+
+test('hasBackendDirectProcessEnvRead detecta lecturas directas de process.env', () => {
+  const directEnvAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'VariableDeclaration',
+        declarations: [
+          {
+            type: 'VariableDeclarator',
+            id: { type: 'Identifier', name: 'databaseUrl' },
+            init: {
+              type: 'MemberExpression',
+              loc: { start: { line: 6 }, end: { line: 6 } },
+              object: {
+                type: 'MemberExpression',
+                object: { type: 'Identifier', name: 'process' },
+                property: { type: 'Identifier', name: 'env' },
+              },
+              property: { type: 'Identifier', name: 'DATABASE_URL' },
+            },
+          },
+        ],
+      },
+    ],
+  };
+  const configServiceAst = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      object: { type: 'Identifier', name: 'configService' },
+      property: { type: 'Identifier', name: 'getOrThrow' },
+    },
+    arguments: [{ type: 'StringLiteral', value: 'DATABASE_URL' }],
+  };
+
+  assert.equal(hasBackendDirectProcessEnvRead(directEnvAst), true);
+  assert.deepEqual(findBackendDirectProcessEnvReadLines(directEnvAst), [6]);
+  assert.equal(hasBackendDirectProcessEnvRead(configServiceAst), false);
+});
+
+test('hasBackendConfigModuleWithoutValidation detecta ConfigModule sin validacion de env', () => {
+  const missingValidationAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ExpressionStatement',
+        expression: {
+          type: 'CallExpression',
+          loc: { start: { line: 8 }, end: { line: 11 } },
+          callee: {
+            type: 'MemberExpression',
+            object: { type: 'Identifier', name: 'ConfigModule' },
+            property: { type: 'Identifier', name: 'forRoot' },
+          },
+          arguments: [
+            {
+              type: 'ObjectExpression',
+              properties: [
+                {
+                  type: 'ObjectProperty',
+                  key: { type: 'Identifier', name: 'isGlobal' },
+                  value: { type: 'BooleanLiteral', value: true },
+                },
+              ],
+            },
+          ],
+        },
+      },
+    ],
+  };
+  const validatedAst = {
+    type: 'CallExpression',
+    loc: { start: { line: 18 }, end: { line: 21 } },
+    callee: {
+      type: 'MemberExpression',
+      object: { type: 'Identifier', name: 'ConfigModule' },
+      property: { type: 'Identifier', name: 'forRoot' },
+    },
+    arguments: [
+      {
+        type: 'ObjectExpression',
+        properties: [
+          {
+            type: 'ObjectProperty',
+            key: { type: 'Identifier', name: 'validationSchema' },
+            value: { type: 'Identifier', name: 'envSchema' },
+          },
+        ],
+      },
+    ],
+  };
+
+  assert.equal(hasBackendConfigModuleWithoutValidation(missingValidationAst), true);
+  assert.deepEqual(findBackendConfigModuleWithoutValidationLines(missingValidationAst), [8]);
+  assert.equal(hasBackendConfigModuleWithoutValidation(validatedAst), false);
+});
+
 test('hasBackendMagicNumberLiteral detecta numeros inline y permite constantes nombradas', () => {
   const inlineMagicNumberAst = {
     type: 'ReturnStatement',
@@ -715,87 +974,280 @@ test('hasBackendControllerEntityResponse detecta entidades expuestas por control
   assert.equal(hasBackendControllerEntityResponse(dtoReturnTypeAst), false);
 });
 
-test('hasBackendAnemicDomainModel detecta entidades de dominio anemicas', () => {
-  const anemicEntityAst = {
-    type: 'ClassDeclaration',
-    id: { type: 'Identifier', name: 'OrderEntity' },
-    body: {
-      type: 'ClassBody',
-      body: [
-        { type: 'ClassProperty', key: { type: 'Identifier', name: 'id' } },
-        { type: 'ClassProperty', key: { type: 'Identifier', name: 'status' } },
-        {
-          type: 'ClassMethod',
-          kind: 'method',
-          key: { type: 'Identifier', name: 'getStatus' },
-          body: { type: 'BlockStatement', body: [] },
-        },
-        {
-          type: 'ClassMethod',
-          kind: 'method',
-          key: { type: 'Identifier', name: 'setStatus' },
-          body: { type: 'BlockStatement', body: [] },
-        },
-      ],
-    },
-  };
-  const richEntityAst = {
-    type: 'ClassDeclaration',
-    id: { type: 'Identifier', name: 'OrderEntity' },
-    body: {
-      type: 'ClassBody',
-      body: [
-        { type: 'ClassProperty', key: { type: 'Identifier', name: 'id' } },
-        { type: 'ClassProperty', key: { type: 'Identifier', name: 'status' } },
-        {
-          type: 'ClassMethod',
-          kind: 'method',
-          key: { type: 'Identifier', name: 'markAsPaid' },
-          body: { type: 'BlockStatement', body: [] },
-        },
-      ],
-    },
-  };
-
-  assert.equal(hasBackendAnemicDomainModel(anemicEntityAst), true);
-  assert.equal(hasBackendAnemicDomainModel(richEntityAst), false);
-});
-
-test('hasBackendPermissiveCorsConfiguration detecta CORS permisivo y permite origenes acotados', () => {
-  const permissiveAst = {
+test('hasBackendControllerBusinessLogic detecta logica dentro de rutas controller NestJS', () => {
+  const controllerWithLogicAst = {
     type: 'Program',
     body: [
       {
-        type: 'CallExpression',
-        loc: { start: { line: 3 }, end: { line: 3 } },
-        callee: {
-          type: 'MemberExpression',
-          computed: false,
-          object: { type: 'Identifier', name: 'app' },
-          property: { type: 'Identifier', name: 'enableCors' },
-        },
-        arguments: [],
-      },
-      {
-        type: 'CallExpression',
-        loc: { start: { line: 7 }, end: { line: 7 } },
-        callee: {
-          type: 'MemberExpression',
-          computed: false,
-          object: { type: 'Identifier', name: 'NestFactory' },
-          property: { type: 'Identifier', name: 'create' },
-        },
-        arguments: [
-          { type: 'Identifier', name: 'AppModule' },
+        type: 'ClassDeclaration',
+        decorators: [
           {
-            type: 'ObjectExpression',
-            properties: [
-              {
-                type: 'ObjectProperty',
-                key: { type: 'Identifier', name: 'cors' },
-                value: { type: 'BooleanLiteral', value: true },
-              },
-            ],
+            type: 'Decorator',
+            expression: {
+              type: 'CallExpression',
+              callee: { type: 'Identifier', name: 'Controller' },
+              arguments: [],
+            },
+          },
+        ],
+        body: {
+          type: 'ClassBody',
+          body: [
+            {
+              type: 'ClassMethod',
+              key: { type: 'Identifier', name: 'createOrder' },
+              loc: { start: { line: 18 }, end: { line: 30 } },
+              decorators: [
+                {
+                  type: 'Decorator',
+                  expression: {
+                    type: 'CallExpression',
+                    callee: { type: 'Identifier', name: 'Post' },
+                    arguments: [],
+                  },
+                },
+              ],
+              body: {
+                type: 'BlockStatement',
+                body: [
+                  {
+                    type: 'IfStatement',
+                    test: { type: 'Identifier', name: 'invalid' },
+                    consequent: { type: 'BlockStatement', body: [] },
+                  },
+                ],
+              },
+            },
+          ],
+        },
+      },
+    ],
+  };
+  const thinControllerAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ClassDeclaration',
+        decorators: [
+          {
+            type: 'Decorator',
+            expression: {
+              type: 'CallExpression',
+              callee: { type: 'Identifier', name: 'Controller' },
+              arguments: [],
+            },
+          },
+        ],
+        body: {
+          type: 'ClassBody',
+          body: [
+            {
+              type: 'ClassMethod',
+              key: { type: 'Identifier', name: 'createOrder' },
+              decorators: [
+                {
+                  type: 'Decorator',
+                  expression: {
+                    type: 'CallExpression',
+                    callee: { type: 'Identifier', name: 'Post' },
+                    arguments: [],
+                  },
+                },
+              ],
+              body: {
+                type: 'BlockStatement',
+                body: [
+                  {
+                    type: 'ReturnStatement',
+                    argument: {
+                      type: 'CallExpression',
+                      callee: {
+                        type: 'MemberExpression',
+                        object: {
+                          type: 'MemberExpression',
+                          object: { type: 'ThisExpression' },
+                          property: { type: 'Identifier', name: 'ordersService' },
+                        },
+                        property: { type: 'Identifier', name: 'create' },
+                      },
+                      arguments: [],
+                    },
+                  },
+                ],
+              },
+            },
+          ],
+        },
+      },
+    ],
+  };
+
+  assert.equal(hasBackendControllerBusinessLogic(controllerWithLogicAst), true);
+  assert.equal(hasBackendControllerBusinessLogic(thinControllerAst), false);
+
+  const match = findBackendControllerBusinessLogicMatch(controllerWithLogicAst);
+  assert.ok(match);
+  assert.deepEqual(match.lines, [18]);
+  assert.equal(match.primary_node, 'createOrder');
+});
+
+test('hasBackendRepositoryBusinessLogic detecta decisiones de negocio dentro de repositories', () => {
+  const repositoryWithLogicAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ClassDeclaration',
+        id: { type: 'Identifier', name: 'OrdersRepository' },
+        body: {
+          type: 'ClassBody',
+          body: [
+            {
+              type: 'ClassMethod',
+              key: { type: 'Identifier', name: 'saveOrder' },
+              loc: { start: { line: 27 }, end: { line: 35 } },
+              body: {
+                type: 'BlockStatement',
+                body: [
+                  {
+                    type: 'IfStatement',
+                    test: { type: 'Identifier', name: 'isPremium' },
+                    consequent: { type: 'BlockStatement', body: [] },
+                  },
+                ],
+              },
+            },
+          ],
+        },
+      },
+    ],
+  };
+  const thinRepositoryAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ClassDeclaration',
+        id: { type: 'Identifier', name: 'OrdersRepository' },
+        body: {
+          type: 'ClassBody',
+          body: [
+            {
+              type: 'ClassMethod',
+              key: { type: 'Identifier', name: 'findActiveOrdersByUserId' },
+              body: {
+                type: 'BlockStatement',
+                body: [
+                  {
+                    type: 'ReturnStatement',
+                    argument: {
+                      type: 'CallExpression',
+                      callee: {
+                        type: 'MemberExpression',
+                        object: { type: 'Identifier', name: 'queryBuilder' },
+                        property: { type: 'Identifier', name: 'where' },
+                      },
+                      arguments: [],
+                    },
+                  },
+                ],
+              },
+            },
+          ],
+        },
+      },
+    ],
+  };
+
+  assert.equal(hasBackendRepositoryBusinessLogic(repositoryWithLogicAst), true);
+  assert.equal(hasBackendRepositoryBusinessLogic(thinRepositoryAst), false);
+
+  const match = findBackendRepositoryBusinessLogicMatch(repositoryWithLogicAst);
+  assert.ok(match);
+  assert.deepEqual(match.lines, [27]);
+  assert.equal(match.primary_node, 'OrdersRepository');
+  assert.deepEqual(match.related_nodes, ['saveOrder']);
+});
+
+test('hasBackendAnemicDomainModel detecta entidades de dominio anemicas', () => {
+  const anemicEntityAst = {
+    type: 'ClassDeclaration',
+    id: { type: 'Identifier', name: 'OrderEntity' },
+    body: {
+      type: 'ClassBody',
+      body: [
+        { type: 'ClassProperty', key: { type: 'Identifier', name: 'id' } },
+        { type: 'ClassProperty', key: { type: 'Identifier', name: 'status' } },
+        {
+          type: 'ClassMethod',
+          kind: 'method',
+          key: { type: 'Identifier', name: 'getStatus' },
+          body: { type: 'BlockStatement', body: [] },
+        },
+        {
+          type: 'ClassMethod',
+          kind: 'method',
+          key: { type: 'Identifier', name: 'setStatus' },
+          body: { type: 'BlockStatement', body: [] },
+        },
+      ],
+    },
+  };
+  const richEntityAst = {
+    type: 'ClassDeclaration',
+    id: { type: 'Identifier', name: 'OrderEntity' },
+    body: {
+      type: 'ClassBody',
+      body: [
+        { type: 'ClassProperty', key: { type: 'Identifier', name: 'id' } },
+        { type: 'ClassProperty', key: { type: 'Identifier', name: 'status' } },
+        {
+          type: 'ClassMethod',
+          kind: 'method',
+          key: { type: 'Identifier', name: 'markAsPaid' },
+          body: { type: 'BlockStatement', body: [] },
+        },
+      ],
+    },
+  };
+
+  assert.equal(hasBackendAnemicDomainModel(anemicEntityAst), true);
+  assert.equal(hasBackendAnemicDomainModel(richEntityAst), false);
+});
+
+test('hasBackendPermissiveCorsConfiguration detecta CORS permisivo y permite origenes acotados', () => {
+  const permissiveAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'CallExpression',
+        loc: { start: { line: 3 }, end: { line: 3 } },
+        callee: {
+          type: 'MemberExpression',
+          computed: false,
+          object: { type: 'Identifier', name: 'app' },
+          property: { type: 'Identifier', name: 'enableCors' },
+        },
+        arguments: [],
+      },
+      {
+        type: 'CallExpression',
+        loc: { start: { line: 7 }, end: { line: 7 } },
+        callee: {
+          type: 'MemberExpression',
+          computed: false,
+          object: { type: 'Identifier', name: 'NestFactory' },
+          property: { type: 'Identifier', name: 'create' },
+        },
+        arguments: [
+          { type: 'Identifier', name: 'AppModule' },
+          {
+            type: 'ObjectExpression',
+            properties: [
+              {
+                type: 'ObjectProperty',
+                key: { type: 'Identifier', name: 'cors' },
+                value: { type: 'BooleanLiteral', value: true },
+              },
+            ],
           },
         ],
       },
@@ -891,6 +1343,55 @@ test('hasBackendStringLiteralUnionEnumCandidate detecta uniones de literales str
   assert.equal(hasBackendStringLiteralUnionEnumCandidate(openUnionAst), false);
 });
 
+test('hasBackendSensitiveCacheWrite detecta datos sensibles escritos en cache', () => {
+  const sensitiveCacheAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ExpressionStatement',
+        expression: {
+          type: 'CallExpression',
+          loc: { start: { line: 18 }, end: { line: 18 } },
+          callee: {
+            type: 'MemberExpression',
+            object: { type: 'Identifier', name: 'cacheManager' },
+            property: { type: 'Identifier', name: 'set' },
+          },
+          arguments: [
+            { type: 'StringLiteral', value: 'session:token' },
+            { type: 'Identifier', name: 'accessToken' },
+          ],
+        },
+      },
+    ],
+  };
+  const safeCacheAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ExpressionStatement',
+        expression: {
+          type: 'CallExpression',
+          loc: { start: { line: 27 }, end: { line: 27 } },
+          callee: {
+            type: 'MemberExpression',
+            object: { type: 'Identifier', name: 'cacheManager' },
+            property: { type: 'Identifier', name: 'set' },
+          },
+          arguments: [
+            { type: 'StringLiteral', value: 'products:list' },
+            { type: 'Identifier', name: 'products' },
+          ],
+        },
+      },
+    ],
+  };
+
+  assert.equal(hasBackendSensitiveCacheWrite(sensitiveCacheAst), true);
+  assert.deepEqual(findBackendSensitiveCacheWriteLines(sensitiveCacheAst), [18]);
+  assert.equal(hasBackendSensitiveCacheWrite(safeCacheAst), false);
+});
+
 test('hasBackendHardDeleteWithoutSoftDelete detecta borrados fisicos en persistencia backend', () => {
   const hardDeleteAst = {
     type: 'Program',
@@ -2677,8 +3178,8 @@ test('hasDtoPropertyWithoutValidation detecta DTOs sin validacion class-validato
   assert.deepEqual(match.related_nodes, ['email']);
 });
 
-test('hasDtoNestedPropertyWithoutNestedValidation detecta DTOs anidados sin ValidateNested y Type', () => {
-  const missingNestedValidationAst = {
+test('hasDtoPropertyWithoutApiProperty detecta DTOs sin decoradores Swagger', () => {
+  const missingSwaggerAst = {
     type: 'Program',
     body: [
       {
@@ -2689,22 +3190,25 @@ test('hasDtoNestedPropertyWithoutNestedValidation detecta DTOs anidados sin Vali
           body: [
             {
               type: 'ClassProperty',
-              key: { type: 'Identifier', name: 'address' },
-              loc: { start: { line: 9 }, end: { line: 9 } },
-              typeAnnotation: {
-                type: 'TSTypeAnnotation',
-                typeAnnotation: {
-                  type: 'TSTypeReference',
-                  typeName: { type: 'Identifier', name: 'AddressDto' },
+              key: { type: 'Identifier', name: 'email' },
+              loc: { start: { line: 7 }, end: { line: 7 } },
+              decorators: [
+                {
+                  type: 'Decorator',
+                  expression: {
+                    type: 'CallExpression',
+                    callee: { type: 'Identifier', name: 'IsEmail' },
+                    arguments: [],
+                  },
                 },
-              },
+              ],
             },
           ],
         },
       },
     ],
   };
-  const validNestedDtoAst = {
+  const swaggerDtoAst = {
     type: 'Program',
     body: [
       {
@@ -2715,20 +3219,82 @@ test('hasDtoNestedPropertyWithoutNestedValidation detecta DTOs anidados sin Vali
           body: [
             {
               type: 'ClassProperty',
-              key: { type: 'Identifier', name: 'address' },
+              key: { type: 'Identifier', name: 'email' },
+              loc: { start: { line: 14 }, end: { line: 14 } },
               decorators: [
                 {
                   type: 'Decorator',
                   expression: {
                     type: 'CallExpression',
-                    callee: { type: 'Identifier', name: 'ValidateNested' },
+                    callee: { type: 'Identifier', name: 'ApiProperty' },
                     arguments: [],
                   },
                 },
-                {
-                  type: 'Decorator',
-                  expression: {
-                    type: 'CallExpression',
+              ],
+            },
+          ],
+        },
+      },
+    ],
+  };
+
+  assert.equal(hasDtoPropertyWithoutApiProperty(missingSwaggerAst), true);
+  assert.deepEqual(findDtoPropertyWithoutApiPropertyLines(missingSwaggerAst), [7]);
+  assert.equal(hasDtoPropertyWithoutApiProperty(swaggerDtoAst), false);
+});
+
+test('hasDtoNestedPropertyWithoutNestedValidation detecta DTOs anidados sin ValidateNested y Type', () => {
+  const missingNestedValidationAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ClassDeclaration',
+        id: { type: 'Identifier', name: 'CreateOrderDto' },
+        body: {
+          type: 'ClassBody',
+          body: [
+            {
+              type: 'ClassProperty',
+              key: { type: 'Identifier', name: 'address' },
+              loc: { start: { line: 9 }, end: { line: 9 } },
+              typeAnnotation: {
+                type: 'TSTypeAnnotation',
+                typeAnnotation: {
+                  type: 'TSTypeReference',
+                  typeName: { type: 'Identifier', name: 'AddressDto' },
+                },
+              },
+            },
+          ],
+        },
+      },
+    ],
+  };
+  const validNestedDtoAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ClassDeclaration',
+        id: { type: 'Identifier', name: 'CreateOrderDto' },
+        body: {
+          type: 'ClassBody',
+          body: [
+            {
+              type: 'ClassProperty',
+              key: { type: 'Identifier', name: 'address' },
+              decorators: [
+                {
+                  type: 'Decorator',
+                  expression: {
+                    type: 'CallExpression',
+                    callee: { type: 'Identifier', name: 'ValidateNested' },
+                    arguments: [],
+                  },
+                },
+                {
+                  type: 'Decorator',
+                  expression: {
+                    type: 'CallExpression',
                     callee: { type: 'Identifier', name: 'Type' },
                     arguments: [],
                   },
@@ -2758,6 +3324,225 @@ test('hasDtoNestedPropertyWithoutNestedValidation detecta DTOs anidados sin Vali
   assert.deepEqual(match.related_nodes, ['address']);
 });
 
+test('hasBackendMissingGlobalValidationPipe detecta bootstrap NestJS sin ValidationPipe estricto', () => {
+  const missingPipeAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ExpressionStatement',
+        expression: {
+          type: 'CallExpression',
+          loc: { start: { line: 7 }, end: { line: 7 } },
+          callee: {
+            type: 'MemberExpression',
+            object: { type: 'Identifier', name: 'NestFactory' },
+            property: { type: 'Identifier', name: 'create' },
+          },
+          arguments: [],
+        },
+      },
+    ],
+  };
+  const unsafePipeAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ExpressionStatement',
+        expression: {
+          type: 'CallExpression',
+          loc: { start: { line: 11 }, end: { line: 11 } },
+          callee: {
+            type: 'MemberExpression',
+            object: { type: 'Identifier', name: 'app' },
+            property: { type: 'Identifier', name: 'useGlobalPipes' },
+          },
+          arguments: [
+            {
+              type: 'NewExpression',
+              callee: { type: 'Identifier', name: 'ValidationPipe' },
+              arguments: [],
+            },
+          ],
+        },
+      },
+    ],
+  };
+  const strictPipeAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ExpressionStatement',
+        expression: {
+          type: 'CallExpression',
+          callee: {
+            type: 'MemberExpression',
+            object: { type: 'Identifier', name: 'NestFactory' },
+            property: { type: 'Identifier', name: 'create' },
+          },
+          arguments: [],
+        },
+      },
+      {
+        type: 'ExpressionStatement',
+        expression: {
+          type: 'CallExpression',
+          callee: {
+            type: 'MemberExpression',
+            object: { type: 'Identifier', name: 'app' },
+            property: { type: 'Identifier', name: 'useGlobalPipes' },
+          },
+          arguments: [
+            {
+              type: 'NewExpression',
+              callee: { type: 'Identifier', name: 'ValidationPipe' },
+              arguments: [
+                {
+                  type: 'ObjectExpression',
+                  properties: [
+                    {
+                      type: 'ObjectProperty',
+                      key: { type: 'Identifier', name: 'whitelist' },
+                      value: { type: 'BooleanLiteral', value: true },
+                    },
+                  ],
+                },
+              ],
+            },
+          ],
+        },
+      },
+    ],
+  };
+
+  assert.equal(hasBackendMissingGlobalValidationPipe(missingPipeAst), true);
+  assert.deepEqual(findBackendMissingGlobalValidationPipeLines(missingPipeAst), [7]);
+  assert.equal(hasBackendMissingGlobalValidationPipe(unsafePipeAst), true);
+  assert.deepEqual(findBackendMissingGlobalValidationPipeLines(unsafePipeAst), [11]);
+  assert.equal(hasBackendMissingGlobalValidationPipe(strictPipeAst), false);
+});
+
+test('hasBackendMissingHelmetSecurityHeaders detecta bootstrap NestJS sin Helmet', () => {
+  const missingHelmetAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ExpressionStatement',
+        expression: {
+          type: 'CallExpression',
+          loc: { start: { line: 9 }, end: { line: 9 } },
+          callee: {
+            type: 'MemberExpression',
+            object: { type: 'Identifier', name: 'NestFactory' },
+            property: { type: 'Identifier', name: 'create' },
+          },
+          arguments: [],
+        },
+      },
+    ],
+  };
+  const helmetAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ExpressionStatement',
+        expression: {
+          type: 'CallExpression',
+          loc: { start: { line: 11 }, end: { line: 11 } },
+          callee: {
+            type: 'MemberExpression',
+            object: { type: 'Identifier', name: 'NestFactory' },
+            property: { type: 'Identifier', name: 'create' },
+          },
+          arguments: [],
+        },
+      },
+      {
+        type: 'ExpressionStatement',
+        expression: {
+          type: 'CallExpression',
+          callee: {
+            type: 'MemberExpression',
+            object: { type: 'Identifier', name: 'app' },
+            property: { type: 'Identifier', name: 'use' },
+          },
+          arguments: [
+            {
+              type: 'CallExpression',
+              callee: { type: 'Identifier', name: 'helmet' },
+              arguments: [],
+            },
+          ],
+        },
+      },
+    ],
+  };
+
+  assert.equal(hasBackendMissingHelmetSecurityHeaders(missingHelmetAst), true);
+  assert.deepEqual(findBackendMissingHelmetSecurityHeadersLines(missingHelmetAst), [9]);
+  assert.equal(hasBackendMissingHelmetSecurityHeaders(helmetAst), false);
+});
+
+test('hasBackendMissingCompressionMiddleware detecta bootstrap NestJS sin compression', () => {
+  const missingCompressionAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ExpressionStatement',
+        expression: {
+          type: 'CallExpression',
+          loc: { start: { line: 9 }, end: { line: 9 } },
+          callee: {
+            type: 'MemberExpression',
+            object: { type: 'Identifier', name: 'NestFactory' },
+            property: { type: 'Identifier', name: 'create' },
+          },
+          arguments: [],
+        },
+      },
+    ],
+  };
+  const compressionAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ExpressionStatement',
+        expression: {
+          type: 'CallExpression',
+          loc: { start: { line: 7 }, end: { line: 7 } },
+          callee: {
+            type: 'MemberExpression',
+            object: { type: 'Identifier', name: 'NestFactory' },
+            property: { type: 'Identifier', name: 'create' },
+          },
+          arguments: [],
+        },
+      },
+      {
+        type: 'ExpressionStatement',
+        expression: {
+          type: 'CallExpression',
+          callee: {
+            type: 'MemberExpression',
+            object: { type: 'Identifier', name: 'app' },
+            property: { type: 'Identifier', name: 'use' },
+          },
+          arguments: [
+            {
+              type: 'CallExpression',
+              callee: { type: 'Identifier', name: 'compression' },
+              arguments: [],
+            },
+          ],
+        },
+      },
+    ],
+  };
+
+  assert.equal(hasBackendMissingCompressionMiddleware(missingCompressionAst), true);
+  assert.deepEqual(findBackendMissingCompressionMiddlewareLines(missingCompressionAst), [9]);
+  assert.equal(hasBackendMissingCompressionMiddleware(compressionAst), false);
+});
+
 test('hasBackendControllerRouteWithoutGuard detecta rutas NestJS sin UseGuards', () => {
   const unguardedRouteAst = {
     type: 'Program',
@@ -2828,3 +3613,239 @@ test('hasBackendControllerRouteWithoutGuard detecta rutas NestJS sin UseGuards',
   assert.equal(hasBackendControllerRouteWithoutGuard(classGuardedRouteAst), false);
   assert.deepEqual(findBackendControllerRouteWithoutGuardLines(unguardedRouteAst), [12]);
 });
+
+test('hasBackendAuthRouteWithoutThrottle detecta endpoints auth sin rate limiting', () => {
+  const loginWithoutThrottleAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ClassDeclaration',
+        decorators: [
+          {
+            type: 'Decorator',
+            expression: { type: 'CallExpression', callee: { type: 'Identifier', name: 'Controller' }, arguments: [] },
+          },
+        ],
+        body: {
+          type: 'ClassBody',
+          body: [
+            {
+              type: 'ClassMethod',
+              key: { type: 'Identifier', name: 'login' },
+              loc: { start: { line: 21 }, end: { line: 24 } },
+              decorators: [
+                {
+                  type: 'Decorator',
+                  expression: {
+                    type: 'CallExpression',
+                    callee: { type: 'Identifier', name: 'Post' },
+                    arguments: [{ type: 'StringLiteral', value: 'login' }],
+                  },
+                },
+              ],
+            },
+          ],
+        },
+      },
+    ],
+  };
+  const classThrottledLoginAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ClassDeclaration',
+        decorators: [
+          {
+            type: 'Decorator',
+            expression: { type: 'CallExpression', callee: { type: 'Identifier', name: 'Controller' }, arguments: [] },
+          },
+          {
+            type: 'Decorator',
+            expression: { type: 'CallExpression', callee: { type: 'Identifier', name: 'Throttle' }, arguments: [] },
+          },
+        ],
+        body: {
+          type: 'ClassBody',
+          body: [
+            {
+              type: 'ClassMethod',
+              key: { type: 'Identifier', name: 'login' },
+              loc: { start: { line: 34 }, end: { line: 37 } },
+              decorators: [
+                {
+                  type: 'Decorator',
+                  expression: {
+                    type: 'CallExpression',
+                    callee: { type: 'Identifier', name: 'Post' },
+                    arguments: [{ type: 'StringLiteral', value: 'login' }],
+                  },
+                },
+              ],
+            },
+          ],
+        },
+      },
+    ],
+  };
+
+  assert.equal(hasBackendAuthRouteWithoutThrottle(loginWithoutThrottleAst), true);
+  assert.deepEqual(findBackendAuthRouteWithoutThrottleLines(loginWithoutThrottleAst), [21]);
+  assert.equal(hasBackendAuthRouteWithoutThrottle(classThrottledLoginAst), false);
+});
+
+test('hasBackendControllerRouteWithoutRoles detecta rutas NestJS protegidas sin RBAC explicito', () => {
+  const guardedWithoutRolesAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ClassDeclaration',
+        decorators: [
+          {
+            type: 'Decorator',
+            expression: { type: 'CallExpression', callee: { type: 'Identifier', name: 'Controller' }, arguments: [] },
+          },
+          {
+            type: 'Decorator',
+            expression: { type: 'CallExpression', callee: { type: 'Identifier', name: 'UseGuards' }, arguments: [] },
+          },
+        ],
+        body: {
+          type: 'ClassBody',
+          body: [
+            {
+              type: 'ClassMethod',
+              key: { type: 'Identifier', name: 'deleteOrder' },
+              loc: { start: { line: 31 }, end: { line: 33 } },
+              decorators: [
+                {
+                  type: 'Decorator',
+                  expression: { type: 'CallExpression', callee: { type: 'Identifier', name: 'Delete' }, arguments: [] },
+                },
+              ],
+            },
+          ],
+        },
+      },
+    ],
+  };
+  const methodRolesAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ClassDeclaration',
+        decorators: [
+          {
+            type: 'Decorator',
+            expression: { type: 'CallExpression', callee: { type: 'Identifier', name: 'Controller' }, arguments: [] },
+          },
+          {
+            type: 'Decorator',
+            expression: { type: 'CallExpression', callee: { type: 'Identifier', name: 'UseGuards' }, arguments: [] },
+          },
+        ],
+        body: {
+          type: 'ClassBody',
+          body: [
+            {
+              type: 'ClassMethod',
+              key: { type: 'Identifier', name: 'deleteOrder' },
+              loc: { start: { line: 42 }, end: { line: 44 } },
+              decorators: [
+                {
+                  type: 'Decorator',
+                  expression: { type: 'CallExpression', callee: { type: 'Identifier', name: 'Roles' }, arguments: [] },
+                },
+                {
+                  type: 'Decorator',
+                  expression: { type: 'CallExpression', callee: { type: 'Identifier', name: 'Delete' }, arguments: [] },
+                },
+              ],
+            },
+          ],
+        },
+      },
+    ],
+  };
+  const unguardedRouteAst = {
+    type: 'ClassMethod',
+    key: { type: 'Identifier', name: 'publicHealth' },
+    loc: { start: { line: 51 }, end: { line: 53 } },
+    decorators: [
+      {
+        type: 'Decorator',
+        expression: { type: 'CallExpression', callee: { type: 'Identifier', name: 'Get' }, arguments: [] },
+      },
+    ],
+  };
+
+  assert.equal(hasBackendControllerRouteWithoutRoles(guardedWithoutRolesAst), true);
+  assert.deepEqual(findBackendControllerRouteWithoutRolesLines(guardedWithoutRolesAst), [31]);
+  assert.equal(hasBackendControllerRouteWithoutRoles(methodRolesAst), false);
+  assert.equal(hasBackendControllerRouteWithoutRoles(unguardedRouteAst), false);
+});
+
+test('hasBackendEventHandlerWithoutOnEvent detecta handlers backend sin decorador OnEvent', () => {
+  const missingOnEventAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ClassDeclaration',
+        id: { type: 'Identifier', name: 'OrderCreatedEventHandler' },
+        loc: { start: { line: 9 }, end: { line: 20 } },
+        decorators: [
+          {
+            type: 'Decorator',
+            expression: { type: 'CallExpression', callee: { type: 'Identifier', name: 'Injectable' }, arguments: [] },
+          },
+        ],
+        body: {
+          type: 'ClassBody',
+          body: [
+            {
+              type: 'ClassMethod',
+              key: { type: 'Identifier', name: 'handleOrderCreatedEvent' },
+              loc: { start: { line: 14 }, end: { line: 18 } },
+              decorators: [],
+            },
+          ],
+        },
+      },
+    ],
+  };
+  const decoratedMethodAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ClassDeclaration',
+        id: { type: 'Identifier', name: 'OrderCreatedEventHandler' },
+        loc: { start: { line: 29 }, end: { line: 40 } },
+        decorators: [
+          {
+            type: 'Decorator',
+            expression: { type: 'CallExpression', callee: { type: 'Identifier', name: 'Injectable' }, arguments: [] },
+          },
+        ],
+        body: {
+          type: 'ClassBody',
+          body: [
+            {
+              type: 'ClassMethod',
+              key: { type: 'Identifier', name: 'handleOrderCreatedEvent' },
+              loc: { start: { line: 34 }, end: { line: 38 } },
+              decorators: [
+                {
+                  type: 'Decorator',
+                  expression: { type: 'CallExpression', callee: { type: 'Identifier', name: 'OnEvent' }, arguments: [] },
+                },
+              ],
+            },
+          ],
+        },
+      },
+    ],
+  };
+
+  assert.equal(hasBackendEventHandlerWithoutOnEvent(missingOnEventAst), true);
+  assert.deepEqual(findBackendEventHandlerWithoutOnEventLines(missingOnEventAst), [9, 14]);
+  assert.equal(hasBackendEventHandlerWithoutOnEvent(decoratedMethodAst), false);
+});