"use strict";
/**
 * Prisma Framework Security Model
 *
 * Prisma Client methods (findMany, findFirst, create, etc.) are parameterised
 * by default. $queryRaw with tagged templates is also safe.
 * $queryRawUnsafe/$executeRawUnsafe and string concatenation bypass protections.
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.prismaModel = void 0;
// Safe ORM patterns — Prisma methods are parameterised by default
const PRISMA_METHOD_RE = /prisma\.\w+\.(findMany|findFirst|findUnique|findFirstOrThrow|findUniqueOrThrow|create|createMany|update|updateMany|upsert|delete|deleteMany|count|aggregate|groupBy)\s*\(/;
// $queryRaw with tagged template literal (Prisma.sql or template tag) is safe
const PRISMA_TAGGED_RAW_RE = /\$queryRaw\s*`/;
// Unsafe patterns
const PRISMA_UNSAFE_RAW_RE = /\$(queryRawUnsafe|executeRawUnsafe)\s*\(/;
const PRISMA_RAW_STRING_CONCAT_RE = /\$(queryRaw|executeRaw)\s*\([^`]*\+/;
exports.prismaModel = {
    framework: 'prisma',
    safePatterns: [
        {
            id: 'orm_prisma_parameterised',
            suppressesCategory: ['sql_injection', 'dangerous_function'],
            detect: (line, _filePath, _fileContent) => PRISMA_METHOD_RE.test(line),
            reason: 'Prisma Client methods use parameterised queries by default — SQL injection not applicable',
        },
        {
            id: 'orm_prisma_tagged_raw',
            suppressesCategory: ['sql_injection'],
            detect: (line, _filePath, _fileContent) => PRISMA_TAGGED_RAW_RE.test(line),
            reason: 'Prisma $queryRaw with tagged template literal is parameterised — SQL injection mitigated',
        },
    ],
    unsafePatterns: [
        {
            id: 'prisma_unsafe_raw_concat',
            boostsCategory: ['sql_injection'],
            detect: (line, _filePath, _fileContent) => PRISMA_UNSAFE_RAW_RE.test(line),
            reason: '$queryRawUnsafe/$executeRawUnsafe accepts raw SQL strings — SQL injection risk',
        },
        {
            id: 'prisma_raw_string_concat',
            boostsCategory: ['sql_injection'],
            detect: (line, _filePath, _fileContent) => {
                // Only flag when concatenation is used (not tagged templates)
                if (PRISMA_TAGGED_RAW_RE.test(line))
                    return false;
                return PRISMA_RAW_STRING_CONCAT_RE.test(line);
            },
            reason: '$queryRaw/$executeRaw with string concatenation bypasses parameterisation — SQL injection risk',
        },
    ],
};
//# sourceMappingURL=prisma.js.map