Whether a JS statement that runs before an auth check only reads, so the
check still comes first in effect. Shared by the Socket.IO and Next.js
auth taggers, which both accept a check only when nothing a refused
caller could use ran before it.
An allow-list: a declaration counts when every call in it (tagged
templates included) has a read-shaped name and nothing in it assigns or
steps a value; a log line counts when its arguments call nothing.
fetch, query, execute, run, del, remove and any name not
recognised are not reads.
Constants
BARE_CALL = /(?<![\w$.])([A-Za-z_$][\w$]*)\s*[(`]/
CALL = /(?<![\w$])([A-Za-z_$][\w$]*)\s*(?:\(|`)/
A call or a tagged template: name( / name`.
DECLARATION = /\A(?:const|let|var)\s+[^=]+?=(?![=>])\s*([\s\S]*?)\s*;?\z/
KEYWORDS =
Set {"if", "for", "while", "switch", "catch", "return", "typeof", "await", "new", "async", "void", "in", "of"}
Words a call scan meets that are not calls of a function.
LOG_CALL = /\A(?:console|log|logger|this\s*\.\s*(?:log|logger))\s*\.\s*(?:log|info|debug|warn|trace|verbose|error|silly)\s*\(([\s\S]*)\)\s*;?\z/
MUTATION = /\+\+|--|(?<![=!<>])=(?![=>])/
x = 1, n++, --q[a] in what should be a value.
READ_NAME = /\
A(?:(?:get|find|load|read|list|count|has|is|lookup|parse|select|validate)(?:[
A-
Z_\d][\w$]*)?|[a-z][\w$]*
To[
A-
Z][\w$]*|json|text|form
Data|array
Buffer|blob|headers|cookies|params|search
Params|keys|values|entries|map|filter|some|every|includes|index
Of|slice|split|trim|join|concat|at|to
String|to
LowerCase|to
UpperCase|to
ISOString|starts
With|ends
With|parse
Int|parse
Float|
Number|
String|
Boolean|
BigInt|
URL|
URLSearchParams|
Date|now|
Set|
Map|
Array|
Object|from|is
Array|require)\z/
getUser, findOne, loadConfig, slugToID, json, map, …
SCHEMA_BUILDER = /\A(?:z|yup|Joi)\s*\.\s*[A-Za-z_$][\w$]*\s*\(/
const schema = z.object({: a validator built from a schema library's
builders, which touch nothing of the app's.
WRITE_METHOD = /\bmethod\s*:\s*(?:["'`](?!GET["'`])|[A-Za-z_$])/i
A request option other than GET: { method: "POST" }.