server-action-audit 0.0.0-stage → 0.2.0

package/dist/cli.js

@@ -0,0 +1,1106 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { isAbsolute, relative as relative2, resolve as resolve2, sep as sep2 } from "path";
+
+// src/format.ts
+var useColor = process.env.FORCE_COLOR ? true : !process.env.NO_COLOR && !!process.stdout.isTTY;
+var paint = (code) => (text) => useColor ? `\x1B[${code}m${text}\x1B[0m` : text;
+var red = paint("31");
+var green = paint("32");
+var yellow = paint("33");
+var cyan = paint("36");
+var dim = paint("2");
+var bold = paint("1");
+function describe(action) {
+  const parts = [];
+  if (action.status === "protected") parts.push(dim(action.reason ?? ""));
+  if (action.status === "public") parts.push(cyan(`public (${action.reason})`));
+  if (action.status === "unprotected") parts.push(red("no auth check"));
+  if (action.validated === false) parts.push(yellow("input not validated"));
+  return parts.join(dim(" \xB7 "));
+}
+function symbol(action) {
+  if (action.status === "unprotected") return red("\u2717");
+  if (action.validated === false) return yellow("!");
+  if (action.status === "public") return cyan("\u25CB");
+  return green("\u2713");
+}
+function formatPretty(report, options = {}) {
+  const { summary } = report;
+  const lines = [];
+  const fileCount = report.files.length;
+  lines.push(bold(`server-action-audit \xB7 ${summary.actions} Server Action${summary.actions === 1 ? "" : "s"} in ${fileCount} file${fileCount === 1 ? "" : "s"}`), "");
+  for (const { file, actions } of report.files) {
+    const shown = options.quiet ? actions.filter((a) => a.status === "unprotected" || a.validated === false) : actions;
+    if (!shown.length) continue;
+    lines.push(bold(file));
+    const width = Math.min(32, Math.max(...shown.map((a) => a.name.length)));
+    for (const action of shown) {
+      const where = dim(`${action.line}:${action.column}`.padEnd(7));
+      lines.push(`  ${symbol(action)} ${action.name.padEnd(width)}  ${where} ${describe(action)}`);
+      if (action.status === "unprotected" && action.hint) lines.push(`      ${dim(action.hint)}`);
+    }
+    lines.push("");
+  }
+  for (const error of report.errors) lines.push(yellow(`skipped ${error.file}: ${error.message}`));
+  if (report.errors.length) lines.push("");
+  if (!summary.actions) {
+    lines.push("No Server Actions found.");
+    return lines.join("\n");
+  }
+  lines.push(
+    [
+      summary.unprotected ? red(`\u2717 ${summary.unprotected} unprotected`) : green("\u2717 0 unprotected"),
+      green(`\u2713 ${summary.protected} protected`),
+      cyan(`\u25CB ${summary.public} public`),
+      summary.unvalidated ? yellow(`! ${summary.unvalidated} with unvalidated input`) : dim("! 0 with unvalidated input")
+    ].join(dim("  \xB7  "))
+  );
+  if (summary.unprotected) {
+    lines.push(
+      "",
+      dim("Every Server Action is a public endpoint: anyone can call it with a POST request."),
+      dim("Check the session inside each action, or mark intentional ones with // @public-action."),
+      dim("https://nextjs.org/docs/app/guides/data-security")
+    );
+  }
+  return lines.join("\n");
+}
+function formatJson(report) {
+  return JSON.stringify(
+    {
+      summary: report.summary,
+      files: report.files.map(({ file, actions }) => ({
+        file,
+        actions: actions.map(({ node: _node, ...action }) => action)
+      })),
+      errors: report.errors
+    },
+    null,
+    2
+  );
+}
+var AUTH_MESSAGE = (name) => `Server Action "${name}" has no authorization check: anyone can call it with a POST request. Check the session inside the action, or mark it with // @public-action if it is public on purpose.`;
+var VALIDATION_MESSAGE = (name) => `Server Action "${name}" uses its arguments without validating them. They come straight from the client: parse them with a schema (Zod, Valibot\u2026).`;
+function findings(report) {
+  const found = [];
+  for (const { file, actions } of report.files) {
+    for (const action of actions) {
+      if (action.status === "unprotected") {
+        found.push({ rule: "require-auth", level: "error", file, action, message: AUTH_MESSAGE(action.name) + (action.hint ? ` ${action.hint}` : "") });
+      }
+      if (action.validated === false) {
+        found.push({ rule: "require-input-validation", level: "warning", file, action, message: VALIDATION_MESSAGE(action.name) });
+      }
+    }
+  }
+  return found;
+}
+function formatGithub(report) {
+  const data = (text) => text.replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A");
+  const property = (text) => data(text).replace(/:/g, "%3A").replace(/,/g, "%2C");
+  const lines = findings(report).map(
+    ({ rule, level, file, action, message }) => `::${level} file=${property(file)},line=${action.line},col=${action.column},title=${property(`server-action-audit/${rule}`)}::${data(message)}`
+  );
+  const { summary } = report;
+  lines.push(`server-action-audit: ${summary.actions} Server Actions, ${summary.unprotected} unprotected, ${summary.protected} protected, ${summary.public} public, ${summary.unvalidated} with unvalidated input.`);
+  return lines.join("\n");
+}
+function formatMarkdown(report, options = {}) {
+  const { summary } = report;
+  const fileCount = report.files.length;
+  const total = `${summary.actions} Server Action${summary.actions === 1 ? "" : "s"} in ${fileCount} file${fileCount === 1 ? "" : "s"}`;
+  const lines = ["### server-action-audit", ""];
+  const found = report.files.flatMap(
+    ({ file, actions }) => actions.filter((action) => action.status === "unprotected" || action.validated === false).map((action) => ({ file, action }))
+  );
+  if (!summary.actions) lines.push("No Server Actions found.");
+  else if (!found.length) lines.push(`\u2705 ${total}, no problems found.`);
+  else {
+    lines.push(
+      [
+        summary.unprotected ? `**\u274C ${summary.unprotected} unprotected**` : "0 unprotected",
+        `${summary.protected} protected`,
+        `${summary.public} public`,
+        summary.unvalidated ? `**\u26A0\uFE0F ${summary.unvalidated} with unvalidated input**` : "0 with unvalidated input"
+      ].join(" \xB7 ") + ` (${total})`,
+      "",
+      "| | Action | Where | Problem |",
+      "| --- | --- | --- | --- |"
+    );
+    const cell = (text) => text.replace(/\|/g, "\\|");
+    const segment = (part) => encodeURIComponent(part).replace(/[()!'*]/g, (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`);
+    const limit = options.limit ?? 50;
+    for (const { file, action } of found.slice(0, limit)) {
+      const where = `${file}:${action.line}`;
+      const link = options.sourceUrl ? `[${cell(where)}](${options.sourceUrl}${file.split("/").map(segment).join("/")}#L${action.line})` : `\`${cell(where)}\``;
+      const unprotected = action.status === "unprotected";
+      const problem = [unprotected && "No authorization check", action.validated === false && (unprotected ? "input not validated" : "Input not validated")].filter(Boolean).join(", ");
+      lines.push(`| ${unprotected ? "\u274C" : "\u26A0\uFE0F"} | \`${cell(action.name)}\` | ${link} | ${problem} |`);
+    }
+    if (found.length > limit) lines.push("", `\u2026and ${found.length - limit} more. Run \`npx server-action-audit\` to see them all.`);
+    if (summary.unprotected) {
+      lines.push(
+        "",
+        "Every Server Action is a public endpoint: anyone can call it with a POST request. Check the session inside each action, or mark intentional ones with `// @public-action`. See the [Next.js data security guide](https://nextjs.org/docs/app/guides/data-security)."
+      );
+    }
+  }
+  if (report.errors.length) {
+    lines.push("", `Skipped ${report.errors.length} file${report.errors.length === 1 ? "" : "s"} that could not be parsed: ${report.errors.map((error) => `\`${error.file}\``).join(", ")}.`);
+  }
+  return lines.join("\n");
+}
+function formatSarif(report, version) {
+  const rules = [
+    {
+      id: "require-auth",
+      name: "RequireAuth",
+      shortDescription: { text: "Server Action without an authorization check" },
+      fullDescription: { text: "Every Next.js Server Action is a public endpoint. This one does not check who is calling it." },
+      helpUri: "https://github.com/i6moons/server-action-audit#readme",
+      defaultConfiguration: { level: "error" },
+      properties: { tags: ["security", "nextjs"], "security-severity": "7.5", precision: "medium" }
+    },
+    {
+      id: "require-input-validation",
+      name: "RequireInputValidation",
+      shortDescription: { text: "Server Action without input validation" },
+      fullDescription: { text: "The action uses arguments sent by the client without parsing them with a schema." },
+      helpUri: "https://github.com/i6moons/server-action-audit#readme",
+      defaultConfiguration: { level: "warning" },
+      properties: { tags: ["security", "nextjs"], "security-severity": "4.0", precision: "medium" }
+    }
+  ];
+  const results = findings(report).map(({ rule, level, file, action, message }) => ({
+    ruleId: rule,
+    ruleIndex: rule === "require-auth" ? 0 : 1,
+    level,
+    message: { text: message },
+    locations: [{ physicalLocation: { artifactLocation: { uri: file }, region: { startLine: action.line, startColumn: action.column } } }],
+    partialFingerprints: { actionName: `${file}#${action.name}` }
+  }));
+  return JSON.stringify(
+    {
+      $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+      version: "2.1.0",
+      runs: [{ tool: { driver: { name: "server-action-audit", version, informationUri: "https://github.com/i6moons/server-action-audit", rules } }, results }]
+    },
+    null,
+    2
+  );
+}
+
+// src/github.ts
+import { readFileSync } from "fs";
+
+// src/version.ts
+var VERSION = "0.2.0";
+
+// src/github.ts
+var COMMENT_MARKER = "<!-- server-action-audit -->";
+function pullRequestFromEnv(env = process.env) {
+  if (!env.GITHUB_REPOSITORY || !env.GITHUB_EVENT_PATH) return "not running in GitHub Actions";
+  if (!env.GITHUB_TOKEN) return "GITHUB_TOKEN is not set";
+  const event = JSON.parse(readFileSync(env.GITHUB_EVENT_PATH, "utf8"));
+  if (!event.pull_request) return `the "${env.GITHUB_EVENT_NAME ?? "unknown"}" event is not about a pull request`;
+  return {
+    apiUrl: env.GITHUB_API_URL || "https://api.github.com",
+    serverUrl: env.GITHUB_SERVER_URL || "https://github.com",
+    repository: env.GITHUB_REPOSITORY,
+    number: event.pull_request.number,
+    headSha: event.pull_request.head?.sha,
+    token: env.GITHUB_TOKEN
+  };
+}
+async function upsertComment(pr, body, options) {
+  const request = async (method, path, payload) => {
+    const response = await (options.fetch ?? fetch)(`${pr.apiUrl}${path}`, {
+      method,
+      headers: {
+        accept: "application/vnd.github+json",
+        authorization: `Bearer ${pr.token}`,
+        "user-agent": `server-action-audit/${VERSION}`,
+        "x-github-api-version": "2022-11-28",
+        ...payload ? { "content-type": "application/json" } : {}
+      },
+      body: payload ? JSON.stringify(payload) : void 0
+    });
+    if (!response.ok) {
+      const message = await response.json().then(
+        (error) => error.message,
+        () => void 0
+      );
+      throw Object.assign(new Error(`${method} ${path} answered ${response.status}${message ? ` ${message}` : ""}`), { status: response.status });
+    }
+    return await response.json();
+  };
+  let previous;
+  for (let page = 1; !previous; page++) {
+    const comments = await request("GET", `/repos/${pr.repository}/issues/${pr.number}/comments?per_page=100&page=${page}`);
+    previous = comments.find((comment) => comment.body?.startsWith(COMMENT_MARKER));
+    if (comments.length < 100) break;
+  }
+  const text = `${COMMENT_MARKER}
+${body}`;
+  if (previous) {
+    if (previous.body === text) return "skipped";
+    await request("PATCH", `/repos/${pr.repository}/issues/comments/${previous.id}`, { body: text });
+    return "updated";
+  }
+  if (options.clean) return "skipped";
+  await request("POST", `/repos/${pr.repository}/issues/${pr.number}/comments`, { body: text });
+  return "created";
+}
+
+// src/scan.ts
+import { existsSync as existsSync2, readFileSync as readFileSync3, readdirSync } from "fs";
+import { join as join2, relative, sep } from "path";
+
+// src/ast.ts
+var SKIP = /* @__PURE__ */ new Set(["parent", "loc", "range", "tokens", "comments", "typeAnnotation", "returnType", "typeParameters"]);
+function walk(root, visit) {
+  if (!root || typeof root.type !== "string") return;
+  if (visit(root) === false) return;
+  for (const key of Object.keys(root)) {
+    if (SKIP.has(key)) continue;
+    const value = root[key];
+    if (Array.isArray(value)) {
+      for (const child of value) if (child && typeof child.type === "string") walk(child, visit);
+    } else if (value && typeof value.type === "string") {
+      walk(value, visit);
+    }
+  }
+}
+function isFunction(node) {
+  return !!node && (node.type === "FunctionDeclaration" || node.type === "FunctionExpression" || node.type === "ArrowFunctionExpression");
+}
+function directives(body) {
+  const found = [];
+  for (const statement of body ?? []) {
+    if (statement.type !== "ExpressionStatement") break;
+    if (typeof statement.directive === "string") found.push(statement.directive);
+    else if (statement.expression?.type === "Literal" && typeof statement.expression.value === "string") found.push(statement.expression.value);
+    else break;
+  }
+  return found;
+}
+function functionDirectives(fn) {
+  return fn.body?.type === "BlockStatement" ? directives(fn.body.body) : [];
+}
+function unwrap(node) {
+  let current = node;
+  while (current.type === "ChainExpression" || current.type === "TSNonNullExpression" || current.type === "TSAsExpression" || current.type === "ParenthesizedExpression") {
+    current = current.expression;
+  }
+  return current;
+}
+function calleePath(callee) {
+  const node = unwrap(callee);
+  if (node.type === "Identifier") return node.name;
+  if (node.type === "MemberExpression") {
+    const property = !node.computed && node.property?.type === "Identifier" ? node.property.name : "*";
+    return `${calleePath(node.object)}.${property}`;
+  }
+  if (node.type === "Super") return "super";
+  if (node.type === "ThisExpression") return "this";
+  return "*";
+}
+function lastSegment(path) {
+  const index = path.lastIndexOf(".");
+  return index === -1 ? path : path.slice(index + 1);
+}
+function callsIn(root) {
+  const calls = [];
+  walk(root, (node) => {
+    if (node.type === "CallExpression") calls.push(node);
+  });
+  return calls;
+}
+function unconditionalCalls(fn, followReturned = false) {
+  const calls = [];
+  const expression = (node) => {
+    if (!node || typeof node.type !== "string" || isFunction(node)) return;
+    if (node.type === "CallExpression") calls.push(node);
+    for (const key of Object.keys(node)) {
+      if (SKIP.has(key)) continue;
+      const value = node[key];
+      if (Array.isArray(value)) value.forEach((child) => child && expression(child));
+      else if (value && typeof value.type === "string") expression(value);
+    }
+  };
+  const returned = (node) => {
+    if (followReturned && node && isFunction(node)) calls.push(...unconditionalCalls(node));
+    else expression(node);
+  };
+  const statement = (node) => {
+    if (!node) return;
+    switch (node.type) {
+      case "BlockStatement":
+        for (const child of node.body ?? []) statement(child);
+        break;
+      case "ExpressionStatement":
+        expression(node.expression);
+        break;
+      case "VariableDeclaration":
+        for (const declarator of node.declarations ?? []) expression(declarator.init);
+        break;
+      case "ReturnStatement":
+        returned(node.argument);
+        break;
+      case "ThrowStatement":
+        expression(node.argument);
+        break;
+      case "IfStatement":
+        expression(node.test);
+        break;
+      case "TryStatement":
+        statement(node.block);
+        break;
+      case "SwitchStatement":
+        expression(node.discriminant);
+        break;
+      case "DoWhileStatement":
+        statement(node.body);
+        break;
+      case "LabeledStatement":
+        statement(node.body);
+        break;
+    }
+  };
+  if (fn.body?.type === "BlockStatement") statement(fn.body);
+  else returned(fn.body);
+  return calls;
+}
+function callChain(call) {
+  const methods = [];
+  const functions = [];
+  const identifiers = [];
+  let current = unwrap(call);
+  for (; ; ) {
+    if (current.type === "CallExpression") {
+      for (const argument of current.arguments ?? []) {
+        if (isFunction(argument)) functions.unshift(argument);
+        else if (argument.type === "Identifier") identifiers.unshift(argument.name);
+      }
+      const callee = unwrap(current.callee);
+      if (callee.type === "MemberExpression") {
+        methods.unshift(!callee.computed && callee.property?.type === "Identifier" ? callee.property.name : "*");
+        current = unwrap(callee.object);
+        continue;
+      }
+      if (callee.type === "Identifier") return { root: callee.name, methods, functions, identifiers };
+      return { root: null, methods, functions, identifiers };
+    }
+    if (current.type === "MemberExpression") {
+      methods.unshift(!current.computed && current.property?.type === "Identifier" ? current.property.name : "*");
+      current = unwrap(current.object);
+      continue;
+    }
+    if (current.type === "AwaitExpression") {
+      current = unwrap(current.argument);
+      continue;
+    }
+    return { root: current.type === "Identifier" ? current.name : null, methods, functions, identifiers };
+  }
+}
+function position(node) {
+  return node.loc ? { line: node.loc.start.line, column: node.loc.start.column + 1 } : { line: 0, column: 0 };
+}
+
+// src/options.ts
+var EXACT_PATHS = ["auth"];
+var NAMES = [
+  "currentUser",
+  // Clerk
+  "getServerSession",
+  // NextAuth v4
+  "getKindeServerSession",
+  // Kinde
+  "validateRequest",
+  // Lucia
+  "getIronSession",
+  // iron-session
+  "withAuth",
+  // WorkOS AuthKit
+  "verifyIdToken",
+  // Firebase Admin
+  "verifySessionCookie",
+  // Firebase Admin
+  "jwtVerify",
+  // jose
+  "verifyToken",
+  "verifyJwt",
+  "verifyAccessToken",
+  "getSession",
+  "verifySession",
+  "getCurrentUser",
+  "getAuthUser",
+  "getAuthenticatedUser",
+  "getSessionUser",
+  "getUserOrThrow",
+  "requireAuth",
+  "requireUser",
+  "requireSession",
+  "requireAdmin",
+  "requireRole",
+  "requirePermission",
+  "checkAuth",
+  "ensureAuth",
+  "ensureUser",
+  "assertAuth",
+  "assertUser",
+  "isAuthenticated",
+  "authenticate",
+  "authorize"
+];
+var SUFFIXES = [
+  "auth.getUser",
+  // Supabase
+  "auth.getClaims",
+  // Supabase
+  "auth.getSession",
+  // Supabase
+  "auth.protect",
+  // Clerk
+  "api.getSession"
+  // Better Auth
+];
+var AUTH_NAME = /auth|protect|guard|session|user|admin|private|secure|logged/i;
+var HELPER_NAME = /auth|session|user|viewer|account|member|owner|admin|role|permission|access|identity|token|login|guard|protect|secure|private|require|ensure|assert|verify|check|current|^me$|^whoami$/i;
+var GUEST_GUARD = /(?:throw|redirect|fail|reject|error)If(?:Authenticated|Authed|LoggedIn|SignedIn|Session)|requireGuest|guestOnly|onlyGuests?|(?:require|ensure|assert)(?:Not|No)(?:Authenticated|LoggedIn|SignedIn|Session|User)|unauthenticated|anonymous/i;
+function resolveOptions(options = {}) {
+  const extra = options.authFunctions ?? [];
+  return {
+    exactPaths: new Set(EXACT_PATHS),
+    names: /* @__PURE__ */ new Set([...NAMES, ...extra.filter((name) => !name.includes("."))]),
+    suffixes: [...SUFFIXES, ...extra.filter((name) => name.includes("."))],
+    authWrappers: new Set(options.authWrappers ?? []),
+    authClients: new Set(options.authClients ?? []),
+    publicActions: new Set(options.publicActions ?? []),
+    ignore: options.ignore ?? []
+  };
+}
+function isAuthCall(path, options) {
+  if (options.exactPaths.has(path)) return true;
+  if (options.names.has(lastSegment(path))) return true;
+  return options.suffixes.some((suffix) => path === suffix || path.endsWith(`.${suffix}`));
+}
+var VALIDATION_METHODS = /* @__PURE__ */ new Set(["parse", "safeParse", "parseAsync", "safeParseAsync", "validate", "validateSync", "validateAsync", "assert"]);
+var NOT_VALIDATION = /* @__PURE__ */ new Set(["JSON", "Date", "Number", "URL", "path", "Math", "BigInt", "console", "assert"]);
+function isValidationCall(path) {
+  const method = lastSegment(path);
+  if (!VALIDATION_METHODS.has(method)) return false;
+  const owner = path.includes(".") ? path.slice(0, path.lastIndexOf(".")) : "";
+  return !NOT_VALIDATION.has(lastSegment(owner) || owner);
+}
+
+// src/analyze.ts
+var PUBLIC_MARKER = /@public-action\b/;
+var CLIENT_METHODS = /* @__PURE__ */ new Set(["action", "stateAction", "handler", "createServerAction", "createAction"]);
+var SCHEMA_METHODS = /* @__PURE__ */ new Set(["schema", "inputSchema", "input", "bindArgsSchemas"]);
+var MAX_DEPTH = 4;
+var ModuleScope = class {
+  constructor(ast, filename) {
+    this.ast = ast;
+    this.filename = filename;
+    for (const statement of ast.body ?? []) this.index(statement);
+  }
+  ast;
+  filename;
+  functions = /* @__PURE__ */ new Map();
+  imports = /* @__PURE__ */ new Map();
+  exports = /* @__PURE__ */ new Map();
+  /** Top-level declarations by name, with the statement that holds them (for comments). */
+  declarations = /* @__PURE__ */ new Map();
+  declare(name, init, statement) {
+    this.declarations.set(name, { init, statement });
+    if (isFunction(init)) this.functions.set(name, init);
+    else if (init.type === "CallExpression") {
+      const wrapped = (init.arguments ?? []).find((argument) => isFunction(argument));
+      if (wrapped) this.functions.set(name, wrapped);
+    }
+  }
+  index(statement) {
+    const declaration = statement.type === "ExportNamedDeclaration" ? statement.declaration : statement;
+    if (statement.type === "ImportDeclaration" && statement.importKind !== "type") {
+      for (const specifier of statement.specifiers ?? []) {
+        const imported = specifier.type === "ImportDefaultSpecifier" ? "default" : specifier.type === "ImportNamespaceSpecifier" ? "*" : specifier.imported?.name ?? specifier.imported?.value;
+        this.imports.set(specifier.local.name, { source: statement.source.value, imported });
+      }
+      return;
+    }
+    if (declaration?.type === "FunctionDeclaration" && declaration.id) {
+      this.declare(declaration.id.name, declaration, statement);
+      if (statement.type === "ExportNamedDeclaration") this.exports.set(declaration.id.name, declaration.id.name);
+    }
+    if (declaration?.type === "VariableDeclaration") {
+      for (const declarator of declaration.declarations ?? []) {
+        if (declarator.id?.type !== "Identifier" || !declarator.init) continue;
+        this.declare(declarator.id.name, declarator.init, statement);
+        if (statement.type === "ExportNamedDeclaration") this.exports.set(declarator.id.name, declarator.id.name);
+      }
+    }
+    if (statement.type === "ExportNamedDeclaration" && !statement.declaration) {
+      for (const specifier of statement.specifiers ?? []) {
+        const exported = specifier.exported?.name ?? specifier.exported?.value;
+        const local = specifier.local?.name ?? specifier.local?.value;
+        this.exports.set(exported, statement.source ? { source: statement.source.value, imported: local } : local);
+      }
+    }
+    if (statement.type === "ExportDefaultDeclaration") {
+      const value = statement.declaration;
+      if (value?.type === "Identifier") this.exports.set("default", value.name);
+      else if (value) {
+        this.declare("default", value, statement);
+        this.exports.set("default", "default");
+      }
+    }
+  }
+};
+function scopeOf(module, context) {
+  let scope = context.scopes.get(module.filename);
+  if (!scope) {
+    scope = new ModuleScope(module.ast, module.filename);
+    context.scopes.set(module.filename, scope);
+  }
+  return scope;
+}
+function resolveFunction(name, scope, context, depth) {
+  const local = scope.functions.get(name);
+  if (local) return { fn: local, scope };
+  const binding = scope.imports.get(name);
+  if (!binding || !context.resolver || depth > MAX_DEPTH) return null;
+  return exportedFunction(binding, scope, context, depth + 1);
+}
+function exportedFunction(binding, from, context, depth) {
+  if (depth > MAX_DEPTH || binding.imported === "*") return null;
+  const module = context.resolver?.(binding.source, from.filename);
+  if (!module) return null;
+  const scope = scopeOf(module, context);
+  const entry = scope.exports.get(binding.imported);
+  if (entry === void 0) return null;
+  if (typeof entry === "string") {
+    const fn = scope.functions.get(entry);
+    return fn ? { fn, scope } : resolveFunction(entry, scope, context, depth);
+  }
+  return exportedFunction(entry, scope, context, depth + 1);
+}
+function authEvidence(fn, scope, context, depth = 0, seen = /* @__PURE__ */ new Set(), followReturned = false) {
+  if (depth > MAX_DEPTH || seen.has(fn)) return null;
+  seen.add(fn);
+  const calls = unconditionalCalls(fn, followReturned);
+  for (const call of calls) {
+    const path = calleePath(call.callee);
+    if (isAuthCall(path, context.options)) return `${path}()`;
+  }
+  for (const call of calls) {
+    const path = calleePath(call.callee);
+    if (path.includes(".") || path === "*" || GUEST_GUARD.test(path) || !HELPER_NAME.test(path)) continue;
+    const helper = resolveFunction(path, scope, context, depth);
+    if (!helper) continue;
+    const evidence = authEvidence(helper.fn, helper.scope, context, depth + 1, seen);
+    if (evidence) return `${path}() \u2192 ${evidence}`;
+  }
+  return null;
+}
+function boundNames(pattern, names = []) {
+  if (!pattern) return names;
+  if (pattern.type === "Identifier") names.push(pattern.name);
+  else if (pattern.type === "ObjectPattern") for (const property of pattern.properties ?? []) boundNames(property.type === "RestElement" ? property.argument : property.value, names);
+  else if (pattern.type === "ArrayPattern") for (const element of pattern.elements ?? []) boundNames(element, names);
+  else if (pattern.type === "AssignmentPattern") boundNames(pattern.left, names);
+  else if (pattern.type === "RestElement") boundNames(pattern.argument, names);
+  return names;
+}
+function closureEvidence(action, enclosing, scope, context) {
+  if (enclosing.body?.type !== "BlockStatement") return null;
+  const fromAuth = /* @__PURE__ */ new Map();
+  for (const statement of enclosing.body.body ?? []) {
+    if (statement.type !== "VariableDeclaration") continue;
+    for (const declarator of statement.declarations ?? []) {
+      const evidence = authEvidence({ type: "ArrowFunctionExpression", params: [], body: declarator.init }, scope, context);
+      if (evidence) for (const name of boundNames(declarator.id)) fromAuth.set(name, evidence);
+    }
+  }
+  if (!fromAuth.size) return null;
+  let found = null;
+  walk(action.body, (node) => {
+    if (found) return false;
+    if (node.type === "Identifier" && fromAuth.has(node.name)) found = `${node.name} from ${fromAuth.get(node.name)} in the enclosing component`;
+  });
+  return found;
+}
+function declarationFrom(binding, from, context, depth) {
+  if (depth > MAX_DEPTH || binding.imported === "*" || !context.resolver) return null;
+  const module = context.resolver(binding.source, from.filename);
+  if (!module) return null;
+  const scope = scopeOf(module, context);
+  const entry = scope.exports.get(binding.imported);
+  if (typeof entry === "string") return resolveDeclaration(entry, scope, context, depth + 1);
+  return entry ? declarationFrom(entry, scope, context, depth + 1) : null;
+}
+function resolveDeclaration(name, scope, context, depth) {
+  const local = scope.declarations.get(name);
+  if (local) return { init: local.init, scope };
+  const binding = scope.imports.get(name);
+  return binding ? declarationFrom(binding, scope, context, depth) : null;
+}
+function definitionEvidence(name, scope, context, depth = 0) {
+  if (depth > MAX_DEPTH || GUEST_GUARD.test(name)) return null;
+  if (depth > 0 && (context.options.authClients.has(name) || context.options.authWrappers.has(name) || AUTH_NAME.test(name))) return name;
+  const definition = resolveFunction(name, scope, context, 0);
+  const evidence = definition && authEvidence(definition.fn, definition.scope, context, 1, /* @__PURE__ */ new Set(), true);
+  if (evidence) return `${name} \u2192 ${evidence}`;
+  const declaration = resolveDeclaration(name, scope, context, 0);
+  if (declaration?.init.type === "CallExpression") {
+    const chain = callChain(declaration.init);
+    for (const base of [chain.root, ...chain.identifiers]) {
+      if (!base || base === name) continue;
+      const inherited = definitionEvidence(base, declaration.scope, context, depth + 1);
+      if (inherited) return `${name} \u2192 ${inherited}`;
+    }
+  }
+  return null;
+}
+function validatesDirectly(fn) {
+  return callsIn(fn.body).some((call) => isValidationCall(calleePath(call.callee)));
+}
+function parameterCount(fn) {
+  return (fn.params ?? []).length;
+}
+function leadingComments(node, comments, text) {
+  const start = node.range?.[0];
+  if (start === void 0) return [];
+  const found = [];
+  let cursor = start;
+  for (const comment of [...comments].reverse()) {
+    const [from, to] = comment.range ?? [Infinity, Infinity];
+    if (to > cursor) continue;
+    if (text.slice(to, cursor).trim() !== "") break;
+    found.push(comment);
+    cursor = from;
+  }
+  return found;
+}
+function bodyHeadComments(fn, comments) {
+  if (fn.body?.type !== "BlockStatement" || !fn.body.range) return [];
+  const [bodyStart, bodyEnd] = fn.body.range;
+  const statements = fn.body.body ?? [];
+  const firstReal = statements.find((statement) => !(statement.type === "ExpressionStatement" && typeof statement.directive === "string"));
+  const limit = firstReal?.range?.[0] ?? bodyEnd;
+  return comments.filter((comment) => comment.range && comment.range[0] > bodyStart && comment.range[1] <= limit);
+}
+function moduleCandidates(scope) {
+  const candidates = [];
+  for (const [exported, entry] of scope.exports) {
+    if (typeof entry !== "string") continue;
+    const declaration = scope.declarations.get(entry);
+    if (!declaration) continue;
+    const { init, statement } = declaration;
+    const target = init.type === "AwaitExpression" ? init.argument : init;
+    if (!isFunction(target) && target.type !== "CallExpression") continue;
+    const name = exported === "default" && target.id?.type === "Identifier" ? target.id.name : exported;
+    candidates.push({ name, kind: "module", target, anchors: [statement, init] });
+  }
+  return candidates;
+}
+function inlineCandidates(ast, skip) {
+  const candidates = [];
+  const visit = (node, parent, grandparent, enclosing) => {
+    if (isFunction(node) && !skip.has(node) && functionDirectives(node).includes("use server")) {
+      let name = node.id?.name;
+      if (!name && parent?.type === "VariableDeclarator" && parent.id?.type === "Identifier") name = parent.id.name;
+      if (!name && (parent?.type === "Property" || parent?.type === "MethodDefinition") && parent.key?.type === "Identifier") name = parent.key.name;
+      if (!name && parent?.type === "JSXExpressionContainer" && grandparent?.type === "JSXAttribute") name = `(inline ${grandparent.name?.name ?? "action"})`;
+      candidates.push({ name: name ?? "(inline)", kind: "inline", target: node, anchors: [parent?.type === "VariableDeclarator" ? grandparent ?? node : node], enclosing });
+    }
+    const inner = isFunction(node) ? node : enclosing;
+    for (const key of Object.keys(node)) {
+      if (key === "parent" || key === "loc" || key === "range") continue;
+      const value = node[key];
+      if (Array.isArray(value)) {
+        for (const child of value) if (child && typeof child.type === "string") visit(child, node, parent, inner);
+      } else if (value && typeof value.type === "string") {
+        visit(value, node, parent, inner);
+      }
+    }
+  };
+  visit(ast, null, null, null);
+  return candidates;
+}
+function analyzeCandidate(candidate, scope, context, comments, text) {
+  const { target } = candidate;
+  let reason = null;
+  let validated = null;
+  let hint = null;
+  const handlers = [];
+  if (isFunction(target)) {
+    handlers.push(target);
+    reason = authEvidence(target, scope, context);
+    if (!reason && candidate.enclosing) reason = closureEvidence(target, candidate.enclosing, scope, context);
+    validated = parameterCount(target) === 0 ? null : validatesDirectly(target);
+  } else {
+    const chain = callChain(target);
+    handlers.push(...chain.functions);
+    const isClient = chain.methods.some((method) => CLIENT_METHODS.has(method));
+    const root = chain.root;
+    const trusted = root !== null && (context.options.authClients.has(root) || context.options.authWrappers.has(root) || AUTH_NAME.test(root) && !GUEST_GUARD.test(root));
+    if (trusted) reason = isClient ? `${root} client` : `${root}() wrapper`;
+    for (const handler of chain.functions) reason ??= authEvidence(handler, scope, context);
+    for (const name of [root, ...chain.identifiers]) {
+      if (!reason && name) reason = definitionEvidence(name, scope, context);
+    }
+    if (isClient) {
+      validated = chain.methods.some((method) => SCHEMA_METHODS.has(method)) ? true : null;
+    } else if (root && /valid|schema|zod|parse/i.test(root)) {
+      validated = true;
+    } else {
+      const handler = chain.functions[0];
+      validated = !handler || parameterCount(handler) === 0 ? null : validatesDirectly(handler);
+    }
+    if (!reason && root) {
+      hint = isClient ? `If "${root}" has auth middleware, add it to "authClients".` : `If ${root}() checks the session, add it to "authWrappers".`;
+    }
+  }
+  const markerComments = [
+    ...candidate.anchors.flatMap((anchor) => leadingComments(anchor, comments, text)),
+    ...handlers.flatMap((handler) => bodyHeadComments(handler, comments))
+  ];
+  const markedPublic = markerComments.some((comment) => PUBLIC_MARKER.test(comment.value));
+  const listedPublic = context.options.publicActions.has(candidate.name);
+  const status = reason ? "protected" : markedPublic || listedPublic ? "public" : "unprotected";
+  if (status === "public") {
+    reason = markedPublic ? "@public-action" : "publicActions";
+    hint = null;
+  }
+  const { line, column } = position(candidate.anchors[0] ?? target);
+  return { name: candidate.name, kind: candidate.kind, line, column, status, reason, validated, hint, node: candidate.anchors[0] ?? target };
+}
+function analyzeModule(input, options, resolver) {
+  if (!input.text.includes("use server")) return [];
+  const context = { options, resolver, scopes: /* @__PURE__ */ new Map() };
+  const scope = scopeOf({ ast: input.ast, filename: input.filename }, context);
+  const comments = input.comments ?? input.ast.comments ?? [];
+  const candidates = [];
+  if (directives(input.ast.body).includes("use server")) candidates.push(...moduleCandidates(scope));
+  const covered = new Set(candidates.map((candidate) => candidate.target));
+  candidates.push(...inlineCandidates(input.ast, covered));
+  return candidates.map((candidate) => analyzeCandidate(candidate, scope, context, comments, input.text)).sort((a, b) => a.line - b.line || a.column - b.column);
+}
+
+// src/resolve.ts
+import { existsSync, readFileSync as readFileSync2, statSync } from "fs";
+import { dirname, join, resolve } from "path";
+import { parse } from "@typescript-eslint/typescript-estree";
+var EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".mts", ".cts"];
+function parseModule(text, filename) {
+  return parse(text, {
+    jsx: !/\.[cm]?ts$/.test(filename),
+    loc: true,
+    range: true,
+    comment: true
+  });
+}
+function isFile(path) {
+  try {
+    return statSync(path).isFile();
+  } catch {
+    return false;
+  }
+}
+var TS_SOURCES = { ".js": [".ts", ".tsx"], ".jsx": [".tsx"], ".mjs": [".mts"], ".cjs": [".cts"] };
+function tryFile(base) {
+  if (isFile(base)) return base;
+  const jsExtension = base.match(/\.(js|jsx|mjs|cjs)$/)?.[0];
+  if (jsExtension) {
+    for (const extension of TS_SOURCES[jsExtension] ?? []) {
+      const candidate = base.slice(0, -jsExtension.length) + extension;
+      if (isFile(candidate)) return candidate;
+    }
+  }
+  for (const extension of EXTENSIONS) if (isFile(base + extension)) return base + extension;
+  for (const extension of EXTENSIONS) if (isFile(join(base, `index${extension}`))) return join(base, `index${extension}`);
+  return null;
+}
+function parseJsonc(text) {
+  let out = "";
+  let inString = false;
+  for (let i = 0; i < text.length; i++) {
+    const char = text[i];
+    if (inString) {
+      out += char;
+      if (char === "\\") out += text[++i] ?? "";
+      else if (char === '"') inString = false;
+    } else if (char === '"') {
+      inString = true;
+      out += char;
+    } else if (char === "/" && text[i + 1] === "/") {
+      while (i < text.length && text[i] !== "\n") i++;
+      out += "\n";
+    } else if (char === "/" && text[i + 1] === "*") {
+      i = text.indexOf("*/", i + 2);
+      if (i === -1) break;
+      i++;
+    } else {
+      out += char;
+    }
+  }
+  return JSON.parse(out.replace(/,(\s*[}\]])/g, "$1"));
+}
+var mappings = /* @__PURE__ */ new Map();
+function pathMapping(fromDir) {
+  if (mappings.has(fromDir)) return mappings.get(fromDir);
+  let mapping = null;
+  for (const name of ["tsconfig.json", "jsconfig.json"]) {
+    const file = join(fromDir, name);
+    if (!existsSync(file)) continue;
+    try {
+      const config = parseJsonc(readFileSync2(file, "utf8"));
+      const options = config.compilerOptions ?? {};
+      if (options.paths) mapping = { base: resolve(fromDir, options.baseUrl ?? "."), paths: options.paths };
+    } catch {
+      mapping = null;
+    }
+    break;
+  }
+  if (!mapping) {
+    const parent = dirname(fromDir);
+    mapping = parent !== fromDir && !existsSync(join(fromDir, "package.json")) ? pathMapping(parent) : null;
+  }
+  mappings.set(fromDir, mapping);
+  return mapping;
+}
+function resolveAlias(specifier, fromFile) {
+  const mapping = pathMapping(dirname(fromFile));
+  if (!mapping) return null;
+  for (const [pattern, targets] of Object.entries(mapping.paths)) {
+    const star = pattern.indexOf("*");
+    let captured = null;
+    if (star === -1) captured = specifier === pattern ? "" : null;
+    else {
+      const prefix = pattern.slice(0, star);
+      const suffix = pattern.slice(star + 1);
+      if (specifier.startsWith(prefix) && specifier.endsWith(suffix) && specifier.length >= prefix.length + suffix.length) {
+        captured = specifier.slice(prefix.length, specifier.length - suffix.length);
+      }
+    }
+    if (captured === null) continue;
+    for (const target of targets) {
+      const file = tryFile(resolve(mapping.base, target.replace("*", captured)));
+      if (file) return file;
+    }
+  }
+  return null;
+}
+function resolveImportPath(specifier, fromFile) {
+  if (specifier.startsWith(".")) return tryFile(resolve(dirname(fromFile), specifier));
+  if (specifier.startsWith("/")) return tryFile(specifier);
+  return resolveAlias(specifier, fromFile);
+}
+function createNodeResolver() {
+  const cache = /* @__PURE__ */ new Map();
+  return (specifier, fromFile) => {
+    const file = resolveImportPath(specifier, fromFile);
+    if (!file) return null;
+    let mtime = 0;
+    try {
+      mtime = statSync(file).mtimeMs;
+    } catch {
+      return null;
+    }
+    const cached = cache.get(file);
+    if (cached && cached.mtime === mtime) return cached.module;
+    let module = null;
+    try {
+      module = { ast: parseModule(readFileSync2(file, "utf8"), file), filename: file };
+    } catch {
+      module = null;
+    }
+    cache.set(file, { mtime, module });
+    return module;
+  };
+}
+
+// src/scan.ts
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".next", ".git", "dist", "build", "out", "coverage", ".turbo", ".vercel", ".output", ".svelte-kit", ".cache"]);
+var SOURCE = /\.(?:[cm]?[jt]s|[jt]sx)$/;
+function globToRegExp(glob) {
+  let pattern = "";
+  for (let i = 0; i < glob.length; i++) {
+    const char = glob[i];
+    if (char === "*" && glob[i + 1] === "*") {
+      pattern += glob[i + 2] === "/" ? "(?:.*/)?" : ".*";
+      i += glob[i + 2] === "/" ? 2 : 1;
+    } else if (char === "*") pattern += "[^/]*";
+    else if (char === "?") pattern += "[^/]";
+    else pattern += char.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(`^${pattern}$`);
+}
+function* sourceFiles(dir) {
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    if (entry.isDirectory()) {
+      if (!SKIP_DIRS.has(entry.name) && !entry.name.startsWith(".")) yield* sourceFiles(join2(dir, entry.name));
+    } else if (entry.isFile() && SOURCE.test(entry.name) && !entry.name.endsWith(".d.ts")) {
+      yield join2(dir, entry.name);
+    }
+  }
+}
+function loadConfig(root, configPath) {
+  if (configPath) return JSON.parse(readFileSync3(configPath, "utf8"));
+  const file = join2(root, "server-action-audit.config.json");
+  if (existsSync2(file)) return JSON.parse(readFileSync3(file, "utf8"));
+  const pkg = join2(root, "package.json");
+  if (existsSync2(pkg)) {
+    const config = JSON.parse(readFileSync3(pkg, "utf8")).serverActionAudit;
+    if (config) return config;
+  }
+  return {};
+}
+function scanProject(root, options = {}) {
+  const resolved = resolveOptions(options);
+  const ignore = resolved.ignore.map(globToRegExp);
+  const resolver = createNodeResolver();
+  const report = { root, files: [], errors: [], summary: { actions: 0, protected: 0, unprotected: 0, public: 0, unvalidated: 0 } };
+  for (const path of sourceFiles(root)) {
+    const file = relative(root, path).split(sep).join("/");
+    if (ignore.some((pattern) => pattern.test(file))) continue;
+    const text = readFileSync3(path, "utf8");
+    if (!text.includes("use server")) continue;
+    let actions;
+    try {
+      actions = analyzeModule({ ast: parseModule(text, path), text, filename: path }, resolved, resolver);
+    } catch (error) {
+      report.errors.push({ file, message: error.message });
+      continue;
+    }
+    if (!actions.length) continue;
+    report.files.push({ file, actions });
+    for (const action of actions) {
+      report.summary.actions++;
+      report.summary[action.status]++;
+      if (action.validated === false) report.summary.unvalidated++;
+    }
+  }
+  report.files.sort((a, b) => a.file.localeCompare(b.file));
+  return report;
+}
+
+// src/cli.ts
+var HELP = `Usage: server-action-audit [dir] [options]
+
+Lists every Next.js Server Action in [dir] (default: current directory) and
+flags the ones without an authorization check.
+
+Options
+  --fail-on <level>   unprotected (default) | unvalidated | never
+  --format <format>   pretty (default) | json | github | sarif | markdown
+                      github: annotations on pull requests (GitHub Actions)
+                      sarif: for GitHub code scanning
+                      markdown: for a job summary
+  --pr-comment        In GitHub Actions, also post the report as a comment
+                      on the pull request, updated on every push. Uses
+                      GITHUB_TOKEN, which needs pull-requests: write
+  --json              Same as --format json
+  --quiet             Only show problems (pretty format)
+  --config <file>     Options file (default: server-action-audit.config.json,
+                      or "serverActionAudit" in package.json)
+  -h, --help          Show this help
+  -v, --version       Show the version
+
+Exit codes: 0 ok, 1 problems found, 2 usage error.
+`;
+function sourceUrl(root, serverUrl, repository, sha) {
+  const path = relative2(process.env.GITHUB_WORKSPACE || process.cwd(), root);
+  if (!sha || path.startsWith("..") || isAbsolute(path)) return void 0;
+  return `${serverUrl}/${repository}/blob/${sha}/${path ? `${path.split(sep2).join("/")}/` : ""}`;
+}
+async function commentOnPullRequest(report, root) {
+  let pr;
+  try {
+    pr = pullRequestFromEnv();
+  } catch (error) {
+    pr = `cannot read the event (${error.message})`;
+  }
+  if (typeof pr === "string") {
+    process.stderr.write(`--pr-comment: no comment, ${pr}.
+`);
+    return;
+  }
+  const { unprotected, unvalidated } = report.summary;
+  try {
+    const body = formatMarkdown(report, { sourceUrl: sourceUrl(root, pr.serverUrl, pr.repository, pr.headSha) });
+    const result = await upsertComment(pr, body, { clean: !unprotected && !unvalidated });
+    const done = { created: "commented on", updated: "updated its comment on", skipped: "nothing new to post on" }[result];
+    process.stderr.write(`--pr-comment: ${done} pull request #${pr.number}.
+`);
+  } catch (error) {
+    const { message, status } = error;
+    const hint = status === 403 || status === 404 ? ' The job needs "permissions: pull-requests: write" (pull requests from forks only get a read-only token).' : "";
+    process.stderr.write(`::warning title=server-action-audit::Could not comment on pull request #${pr.number}: ${message}.${hint}
+`);
+  }
+}
+async function main(argv) {
+  let dir = ".";
+  let format = "pretty";
+  let quiet = false;
+  let prComment = false;
+  let failOn = "unprotected";
+  let configPath;
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "-h" || arg === "--help") {
+      process.stdout.write(HELP);
+      return 0;
+    }
+    if (arg === "-v" || arg === "--version") {
+      process.stdout.write(`${VERSION}
+`);
+      return 0;
+    }
+    if (arg === "--json") format = "json";
+    else if (arg === "--format" || arg.startsWith("--format=")) format = arg.includes("=") ? arg.split("=")[1] : argv[++i] ?? "";
+    else if (arg === "--quiet") quiet = true;
+    else if (arg === "--pr-comment") prComment = true;
+    else if (arg === "--fail-on" || arg.startsWith("--fail-on=")) failOn = arg.includes("=") ? arg.split("=")[1] : argv[++i] ?? "";
+    else if (arg === "--config" || arg.startsWith("--config=")) configPath = arg.includes("=") ? arg.split("=")[1] : argv[++i];
+    else if (arg.startsWith("-")) {
+      process.stderr.write(`Unknown option: ${arg}
+
+${HELP}`);
+      return 2;
+    } else dir = arg;
+  }
+  if (!["pretty", "json", "github", "sarif", "markdown"].includes(format)) {
+    process.stderr.write(`--format must be pretty, json, github, sarif or markdown (got "${format}").
+`);
+    return 2;
+  }
+  if (!["unprotected", "unvalidated", "never"].includes(failOn)) {
+    process.stderr.write(`--fail-on must be unprotected, unvalidated or never (got "${failOn}").
+`);
+    return 2;
+  }
+  const root = resolve2(dir);
+  let report;
+  try {
+    report = scanProject(root, loadConfig(root, configPath && resolve2(configPath)));
+  } catch (error) {
+    process.stderr.write(`server-action-audit: ${error.message}
+`);
+    return 2;
+  }
+  const output = format === "json" ? formatJson(report) : format === "github" ? formatGithub(report) : format === "sarif" ? formatSarif(report, VERSION) : format === "markdown" ? formatMarkdown(report) : formatPretty(report, { quiet });
+  process.stdout.write(`${output}
+`);
+  if (prComment) await commentOnPullRequest(report, root);
+  const { unprotected, unvalidated } = report.summary;
+  if (failOn === "unprotected" && unprotected) return 1;
+  if (failOn === "unvalidated" && (unprotected || unvalidated)) return 1;
+  return 0;
+}
+process.exitCode = await main(process.argv.slice(2));
+//# sourceMappingURL=cli.js.map