"use strict";
/**
 * Auth Access Prompt Module
 *
 * Categories: missing_auth, security_bypass
 * Contains contradiction handling rules that require AI reasoning.
 * Heuristic-handled patterns (middleware awareness, throwing helpers) are NOT included.
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.AUTH_ACCESS_MODULE = void 0;
exports.AUTH_ACCESS_MODULE = `
### Authentication & Access Control

Flag as REAL vulnerability (keep high severity) ONLY when:
- Route has no visible auth check AND is NOT covered by middleware AND has no throwing auth helper
- Sensitive operations without user scoping (cross-tenant access possible)
- Auth checks that can be bypassed (e.g., checking wrong variable)

**CRITICAL CONTRADICTION HANDLING**:
- If we detect both "protected by middleware" and "missing auth" on the same route - REJECT the "missing auth" finding
- If we detect both "uses throwing auth helper" and "missing auth" - REJECT the "missing auth" finding
- Client components calling these protected API routes should NOT be flagged for "missing auth"
- Adding "if (!userId)" after a throwing helper is a FALSE POSITIVE - reject it
`;
//# sourceMappingURL=auth-access.js.map