registry / @jskit-ai/auth-provider-local-core / 0.1.14

@jskit-ai/auth-provider-local-core@0.1.14

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 34 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 9 file(s), 54.0 KB of source

Source & flagged code

29 flagged

src/server/lib/service.jsView file

Lines 128-168javascript

128function buildSessionPayload({ user, session, refreshToken, secret }) {

129 const accessToken = buildAccessToken({ user, session, secret });

130 return {

131 access_token: accessToken,

Source & flagged code

29 flagged · loading source

src/server/lib/service.jsView file

148patternName = generic_password severity = medium line = 148 matchedText = password...rs."

Medium

Secret Pattern

Package contains a possible secret pattern.

src/server/lib/service.jsView on unpkg · L148

test/providerRuntime.test.jsView file

124patternName = generic_password severity = medium line = 124 matchedText = password...le",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L124

215patternName = generic_password severity = medium line = 215 matchedText = password...le",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L215

231patternName = generic_password severity = medium line = 231 matchedText = password...le",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L231

281patternName = generic_password severity = medium line = 281 matchedText = password...ue",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L281

287patternName = generic_password severity = medium line = 287 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L287

389patternName = generic_password severity = medium line = 389 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L389

413patternName = generic_password severity = medium line = 413 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L413

500patternName = generic_password severity = medium line = 500 matchedText = password...ord"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L500

507patternName = generic_password severity = medium line = 507 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L507

545patternName = generic_password severity = medium line = 545 matchedText = password...ue",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L545

550patternName = generic_password severity = medium line = 550 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L550

568patternName = generic_password severity = medium line = 568 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L568

574patternName = generic_password severity = medium line = 574 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L574

589patternName = generic_password severity = medium line = 589 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L589

610patternName = generic_password severity = medium line = 610 matchedText = password...le",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L610

617patternName = generic_password severity = medium line = 617 matchedText = password...ple"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L617

628patternName = generic_password severity = medium line = 628 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L628

659patternName = generic_password severity = medium line = 659 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L659

667patternName = generic_password severity = medium line = 667 matchedText = password...ple"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L667

673patternName = generic_password severity = medium line = 673 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L673

683patternName = generic_password severity = medium line = 683 matchedText = password...le",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L683

707patternName = generic_password severity = medium line = 707 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L707

726patternName = generic_password severity = medium line = 726 matchedText = password...le",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L726

760patternName = generic_password severity = medium line = 760 matchedText = password...ple"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L760

766patternName = generic_password severity = medium line = 766 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L766

792patternName = generic_password severity = medium line = 792 matchedText = password...le",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L792

817patternName = generic_password severity = medium line = 817 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L817

860patternName = generic_password severity = medium line = 860 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L860

Findings

30 Medium4 Low

MediumSecret Patternsrc/server/lib/service.js

MediumEnvironment Vars

MediumSecret Patterntest/providerRuntime.test.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNo License

test/providerRuntime.test.jsView file

Lines 104-144javascript

104 AuthProviderServiceProvider,

105 AuthActionsServiceProvider

106 ]

107 });

108 return {

109 app,

110 storeDir

111 };

112}

113

114test("local auth provider registers, logs in, reads session, and logs out with file backend", async () => {

115 const { app, storeDir } = await createStartedApp();

116 const authService = app.make("authService");

117 const capabilities = authService.getCapabilities();

118 assert.equal(capabilities.provider.id, "local");

119 assert.equal(capabilities.features.password.login, true);

120 assert.equal(capabilities.features.oauthLogin.enabled, false);

121

122 const registered = await authService.register({

123 email: "Ada@example.com",

124 password: "correct horse battery staple",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L124

125 displayName: "Ada"

126 });

127 assert.equal(registered.profile.email, "ada@example.com");

128 assert.equal(registered.actor.provider, "local");

129 assert.equal(registered.requiresEmailConfirmation, false);

130

131 const reply = createReplyFixture();

132 authService.writeSessionCookies(reply, registered.session);

133 assert.equal(Boolean(reply.cookies.jskit_local_access_token), true);

134 assert.equal(Boolean(reply.cookies.jskit_local_refresh_token), true);

135

136 const session = await authService.authenticateRequest({ cookies: reply.cookies });

137 assert.equal(session.authenticated, true);

138 assert.equal(session.actor.email, "ada@example.com");

139

140 const actionExecutor = app.make("actionExecutor");

141 const definitions = actionExecutor.listDefinitions();

142 assert.equal(definitions.some((definition) => definition.id === "auth.login.password"), true);

143 const actionSession = await actionExecutor.execute({

144 actionId: "auth.session.read",

Lines 195-251javascript

195 decoratorId: "test.auth.local.blockingHook",

196 order: 10,

197 hook: {

198 hookId: "permissions",

199 blocking: true,

200 async handle({ actor, profile }) {

201 calls.push({ hook: "permissions", email: actor.email });

Lines 261-307javascript

261test("local auth provider resolves a custom password strategy from the container", async () => {

262 const passwordStrategy = {

263 prefix: "strategy",

264 async hashPassword(password) {

265 return {

266 algorithm: "test-password",

267 version:

Lines 369-433javascript

369 }

370 }

371 });

372 return result;

373 });

374 }

375 };

376 const authService = createLocalAuthService({

377 backend: wrappedBackend,

378 config: {

379 sessionSecret: "test-secret",

500patternName = generic_password severity = medium line = 500 matchedText = password...ord"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L500

507patternName = generic_password severity = medium line = 507 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L507

545patternName = generic_password severity = medium line = 545 matchedText = password...ue",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L545

550patternName = generic_password severity = medium line = 550 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L550

568patternName = generic_password severity = medium line = 568 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L568

574patternName = generic_password severity = medium line = 574 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L574

589patternName = generic_password severity = medium line = 589 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L589

610patternName = generic_password severity = medium line = 610 matchedText = password...le",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L610

617patternName = generic_password severity = medium line = 617 matchedText = password...ple"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L617

628patternName = generic_password severity = medium line = 628 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L628

659patternName = generic_password severity = medium line = 659 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L659

667patternName = generic_password severity = medium line = 667 matchedText = password...ple"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L667

673patternName = generic_password severity = medium line = 673 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L673

683patternName = generic_password severity = medium line = 683 matchedText = password...le",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L683

707patternName = generic_password severity = medium line = 707 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L707

726patternName = generic_password severity = medium line = 726 matchedText = password...le",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L726

760patternName = generic_password severity = medium line = 760 matchedText = password...ple"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L760

766patternName = generic_password severity = medium line = 766 matchedText = password...lue"

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L766

792patternName = generic_password severity = medium line = 792 matchedText = password...le",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L792

817patternName = generic_password severity = medium line = 817 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L817

860patternName = generic_password severity = medium line = 860 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in test/providerRuntime.test.js

test/providerRuntime.test.jsView on unpkg · L860