"use strict";
/**
 * Next.js Framework Security Model
 *
 * App Router Server Components cannot access browser APIs (no DOM XSS).
 * searchParams/params are user-controlled. Server Actions receive FormData.
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.nextjsModel = void 0;
const USE_CLIENT_RE = /['"]use client['"]/;
const SEARCH_PARAMS_RE = /searchParams/;
const PARAMS_RE = /\bparams\b/;
const FORM_DATA_RE = /FormData|formData/;
function isAppRouterServerComponent(filePath) {
    // Files in app/ directory without 'use client' at the top are Server Components
    return /\/app\//.test(filePath) || /\\app\\/.test(filePath);
}
exports.nextjsModel = {
    framework: 'nextjs',
    safePatterns: [
        {
            id: 'nextjs_server_component_no_dom',
            suppressesCategory: ['xss', 'dangerous_function'],
            detect: (_line, filePath, fileContent) => {
                // Server Components can't access DOM — no client-side XSS
                if (!isAppRouterServerComponent(filePath))
                    return false;
                // Check file extension is React
                if (!/\.(tsx|jsx)$/.test(filePath))
                    return false;
                // Client Components have 'use client' — they ARE in the browser
                if (USE_CLIENT_RE.test(fileContent))
                    return false;
                return true;
            },
            reason: 'Next.js Server Component cannot access browser DOM — client-side XSS not applicable',
        },
    ],
    unsafePatterns: [
        {
            id: 'nextjs_search_params_user_input',
            boostsCategory: ['sql_injection', 'xss', 'command_injection', 'ssrf'],
            detect: (line, _filePath, _fileContent) => SEARCH_PARAMS_RE.test(line),
            reason: 'Next.js searchParams are user-controlled input — treat as untrusted',
        },
        {
            id: 'nextjs_params_user_input',
            boostsCategory: ['sql_injection', 'xss', 'command_injection', 'ssrf'],
            detect: (line, _filePath, _fileContent) => {
                // Only flag when it looks like destructuring or accessing params in a handler context
                if (!PARAMS_RE.test(line))
                    return false;
                // Avoid false positives on generic variable names
                return /\{\s*params\s*\}/.test(line) || /params\.\w+/.test(line);
            },
            reason: 'Next.js route params are user-controlled input',
        },
        {
            id: 'nextjs_server_action_form_data',
            boostsCategory: ['sql_injection', 'command_injection', 'xss'],
            detect: (line, _filePath, fileContent) => {
                // Only flag FormData usage in Server Action files
                if (!/['"]use server['"]/.test(fileContent))
                    return false;
                return FORM_DATA_RE.test(line);
            },
            reason: 'Next.js Server Actions receive FormData — user-controlled input',
        },
    ],
};
//# sourceMappingURL=nextjs.js.map