Constants
FASTIFY_EXEMPT = /if\s*\(\s*(?:request|req)\s*\.\s*(?:url|router
Path)\s*===?\s*['"]([^'"]+)['"]\s*\)\s*return\b/
FASTIFY_PATTERNS = [{/on
Request.*authenticate/, "
Fastify on
Request authenticate hook"}, {/pre
Handler.*authenticate/, "
Fastify pre
Handler authenticate"}, {/fastify\.authenticate/, "
Fastify authenticate decorator"}, {/pre
Validation.*auth/i, "
Fastify pre
Validation auth"}, {/@fastify\/jwt/, "
Fastify JWT plugin"}, {/fastify-auth/, "
Fastify auth plugin"}, {/fastify\.auth\s*\(/, "
Fastify auth"}]
FASTIFY_REPLY_401 = /reply\s*\.\s*(?:code|status)\s*\(\s*401\b|\.statusCode\s*=\s*401\b/
reply.code(401) / reply.status(401) inside a hook or preHandler.
FASTIFY_ROUTE = /\.\s*(?:get|post|put|patch|delete|del|head|options|all)\s*\(/
GENERIC_NODE_AUTH = [{/\brequireAuth\b/, "requireAuth middleware"}, {/\bisAuthenticated\b/, "isAuthenticated middleware"}, {/\bensureLoggedIn\b/, "ensureLoggedIn middleware"}, {/\bverifyToken\b/, "verifyToken middleware"}, {/\bcheckAuth\b/, "checkAuth middleware"}, {/\bauthMiddleware\b/, "authMiddleware"}]
Generic Node.js auth middleware (shared across frameworks)
KOA_CALLEE = /\b([A-Za-z_$][\w$]*)\s*\(/
KOA_DISABLING_OPTION = /\b([A-Za-z_$][\w$]*)\s*:\s*(?:true\b|(?:async\s+)?(?:\([^)]*\)|[A-Za-z_$][\w$]*)\s*=>|function\b)/
An option that can switch a check off: optional: true, skip: (ctx) => ….
KOA_MIDDLEWARE_CALL = /\A((?:[A-Za-z_$][\w$]*\s*\.\s*)?[A-Za-z_$][\w$]*)\s*(?:\((.*)\))?\z/m
auth, auth(), mw.requireUser({ … }): the reference and its arguments.
KOA_NOT_CALLEES =
Set {"if", "for", "while", "switch", "catch", "function", "return", "await", "typeof", "next"}
KOA_PATTERNS = [{/koa-passport/, "Koa Passport middleware"}, {/koa-jwt/, "Koa JWT middleware"}, {/koa-session/, "Koa session middleware"}, {/passport\.authenticate\s*\(/, "Koa Passport authenticate"}, {/ctx\.isAuthenticated\s*\(\)/, "Koa isAuthenticated check"}]
KOA_REFUSAL = /\bctx\.throw\s*\(\s*40[13]\b|\bctx\.status\s*=\s*40[13]\b|\bctx\.assert\s*\([^;]*?,\s*40[13]\b|\bthrow\s+(?:new\s+)?\w*(?:Unauthori[sz]ed|Forbidden|Authentication|Authorization)\w*\s*\(/
What a Koa middleware's definition does to refuse a caller: throw
(ctx.throw(401), throw AuthenticationError(…)), assert, or set 401/403.
KOA_ROUTE_CALL = /\.\s*(?:get|post|put|patch|delete|del|all|head|options)\s*\(/
MAX_ROUTE_SCOPE_LINES = 12
RESTIFY_PATTERNS = [{/authorizationParser/, "Restify authorizationParser"}, {/req\.authorization/, "Restify req.authorization check"}, {/req\.username/, "Restify req.username check"}]