fix(observability-map): attribute auth-boundary guards per export

Every input auth-boundary read was entry-point-wide, so one guarded export
spoke for the whole file: calleeNames is the union of both bodies,
checkedCallees was too, and usesBuilder was an OR over both initializer
callees. A file whose loader called requireUser and whose action called
nothing read as guarded in the body, and a createLoaderApiRoute loader
authenticated a hand-written action beside it. This is the same defect
auth-scope was fixed for a round earlier, in its sibling check.

scanFile now splits calleeNames, calleeTexts, checkedCallees, statementCount
and hasTryCatch per export, filled from one push site each so the union and
the split cannot drift apart. usesBuilder had no other caller and is gone.
routeExports is the single enumeration of a file's exports, shared with
auth-scope, which had grown its own [loader, action] literal.

Triviality had to follow, or the fix trades a false pass for a false
accusation: naive per-export attribution moved auth.github.ts and
auth.google.ts to fail, both being a one-line redirect-stub loader beside a
guarded action that the entry-point-wide rule called non-trivial. isTrivial
is now one rule over two views. The per-export view matches the side-effect
hints against that export's own callee paths: the whole file is defeatable
(the corpus's log-caller-scope-userid puts the word logger in the file and
un-excuses the untouched loader) and nothing at all guts the check (five
fixtures go from fail to not-applicable, because calleeNames keeps only a
call's last segment and prisma.x.findMany reads as findMany).

login.mfa's action verifies a TOTP or recovery code, which is a login-surface
proof of possession like the verify* guards already listed, so it joins them
rather than being accused once its loader stops speaking for it.

Real tree unmoved: global 19, 62 auth-boundary applicable, 59 passing, no
route changing any check.

scan.ts also picks up routeModuleFiles here, shared with the corpus harness,
because it sits in the same hunk as the per-export return shape.

Author: 1stvamp

internal-packages/observability-map/src/checks/authBoundary.ts

@@ -1,14 +1,16 @@
 import type { CheckResult, EntryPoint } from "../types.js";
 import { classifySensitivity } from "../sensitivity.js";
-import { isTrivial } from "../triviality.js";
-import { usesBuilder } from "./errorClassification.js";
+import { routeExports, type ExportName, type RouteExport } from "../routeExports.js";
+import { isTrivialExport } from "../triviality.js";
+import { BUILDERS } from "./errorClassification.js";
 
 const ID = "auth-boundary";
 
 /**
- * The guard helpers this webapp actually has, matched against `calleeNames`, which is scoped to the
- * loader/action bodies and follows one hop into a same-file helper. A guard the route only imports
- * and never calls does not count.
+ * The guard helpers this webapp actually has, matched against the calling export's own
+ * `loaderCalleeNames`/`actionCalleeNames`, each scoped to that export's handlers and following one
+ * hop into a same-file helper. A guard the route only imports and never calls does not count, and
+ * neither does one the OTHER export calls.
  *
  * A name list rather than the three patterns it replaces, because all three over-matched and this
  * is the one check where a false pass hides a security gap:
@@ -66,16 +68,22 @@ export const GUARDS = new Set([
   // Local helpers, each declared inside the one route that uses it.
   "authenticateAdmin",
   "authenticatePlainRequest",
-  // Proof of possession: a callback URL carrying an HMAC is authenticated by checking that HMAC.
+  // Proof of possession: a callback URL carrying an HMAC is authenticated by checking that HMAC,
+  // and a login-surface second factor is authenticated by checking the code presented.
+  // `login.mfa`'s action is the second half of a login, so like `authenticate` above it establishes
+  // identity from the credential rather than requiring an already authenticated caller. It reached
+  // this list when per-export attribution stopped its loader's `isAuthenticated` speaking for it.
   "verifyHttpCallbackHash",
   "verifyWebhook",
   "verifyUserActorToken",
+  "verifyTotpForLogin",
+  "verifyRecoveryCodeForLogin",
 ]);
 
 /**
  * Guards that answer with null instead of throwing. Calling one is not evidence of a boundary,
- * because the route is free to ignore the answer, so these are only credited when the body
- * demonstrably reads what they returned (`EntryPoint.checkedCallees`).
+ * because the route is free to ignore the answer, so these are only credited when THAT EXPORT's
+ * handlers demonstrably read what they returned (`EntryPoint.loaderCheckedCallees`).
  *
  * The distinction is the whole reason this set is separate from `GUARDS`. `requireUserId` redirects
  * on its own, so calling it IS the boundary; `getUserId` hands back `string | null` and a route
@@ -85,10 +93,43 @@ export const GUARDS = new Set([
  * rather than something a hand-read established once.
  *
  * What it still cannot see is whether the test that reads the answer guards anything. See
- * `EntryPoint.checkedCallees` for the exact shape of that residual.
+ * `EntryPoint.loaderCheckedCallees` for the exact shape of that residual.
  */
 export const SOFT_GUARDS = new Set(["getUser", "getUserId"]);
 
+type GuardedExport = { name: ExportName; guarded: boolean; how: string; export: RouteExport };
+
+/**
+ * The exports this file declares, each with its own verdict.
+ *
+ * Per export, because the exposure is per export, and this is the same defect `auth-scope` was
+ * fixed for one round earlier. Every input here was entry-point-wide: `calleeNames` is the union of
+ * both bodies, `checkedCallees` was too, and `usesBuilder` was an OR over the two initializer
+ * callees. So a file whose loader called `requireUser` and whose action called nothing read as
+ * "guarded in the body", and a file whose loader was `createLoaderApiRoute(...)` credited its
+ * hand-written action with the builder's authentication. Three inputs, one bug, and it is a false
+ * PASS on the one check where that hides a security gap.
+ *
+ * `routeExports` lists only the exports the file actually declares, so an export that calls nothing
+ * at all is judged rather than skipped: an empty body is exactly the unguarded case. It is shared
+ * with `auth-scope`, which grew its own copy of the same `[loader, action]` literal.
+ */
+function guardedExports(ep: EntryPoint): GuardedExport[] {
+  return routeExports(ep).map((e) => {
+    const verdict = (guarded: boolean, how: string) => ({ name: e.name, guarded, how, export: e });
+    if (e.initializerCallee !== null && BUILDERS.has(e.initializerCallee)) {
+      return verdict(true, "authenticated by the builder");
+    }
+    if (e.calleeNames.some((n) => GUARDS.has(n))) {
+      return verdict(true, "guarded in the body");
+    }
+    if (e.checkedCallees.some((n) => SOFT_GUARDS.has(n))) {
+      return verdict(true, "resolves the caller and reads the answer");
+    }
+    return verdict(false, "");
+  });
+}
+
 /**
  * Whether a route that handles credentials, tokens or money checks who is asking.
  *
@@ -123,26 +164,30 @@ export const authBoundary = {
     if (!sensitivity.sensitive) {
       return { id: ID, status: "not-applicable", detail: "not sensitive" };
     }
-    if (usesBuilder(ep)) {
-      return { id: ID, status: "pass", detail: "authenticated by the builder" };
-    }
-    if (ep.calleeNames.some((n) => GUARDS.has(n))) {
-      return { id: ID, status: "pass", detail: "guarded in the body" };
-    }
-    if (ep.checkedCallees.some((n) => SOFT_GUARDS.has(n))) {
-      return { id: ID, status: "pass", detail: "resolves the caller and reads the answer" };
-    }
-    if (isTrivial(ep)) {
+    // Never empty: `scanFile` returns null unless the file declares a loader or an action.
+    const exports = guardedExports(ep);
+    const guarded = exports.filter((e) => e.guarded);
+    // Triviality excuses per export, matching the attribution: the reasoning below is about one
+    // body being the place a guard would have to be, and reading it entry-point-wide let a busy
+    // action make a redirect-stub loader answerable for a guard it has nothing to guard.
+    const accused = exports.filter((e) => !e.guarded && !isTrivialExport(e.export));
+    if (accused.length > 0) {
       return {
         id: ID,
-        status: "not-applicable",
-        detail: "cannot verify: no privileged work in the body, any guard is behind an import",
+        status: "fail",
+        detail: `sensitive (${sensitivity.reasons.join(", ")}) with no auth guard in the body: ${accused
+          .map((e) => e.name)
+          .join(", ")}`,
       };
     }
+    if (guarded.length > 0) {
+      const how = [...new Set(guarded.map((e) => e.how))].join(" and ");
+      return { id: ID, status: "pass", detail: how };
+    }
     return {
       id: ID,
-      status: "fail",
-      detail: `sensitive (${sensitivity.reasons.join(", ")}) with no auth guard in the body`,
+      status: "not-applicable",
+      detail: "cannot verify: no privileged work in the body, any guard is behind an import",
     };
   },
 };

internal-packages/observability-map/src/checks/authScope.ts

@@ -1,5 +1,6 @@
 import type { CheckResult, EntryPoint } from "../types.js";
 import { classifySensitivity } from "../sensitivity.js";
+import { routeExports } from "../routeExports.js";
 import { BUILDERS } from "./errorClassification.js";
 
 const ID = "auth-scope";
@@ -12,30 +13,22 @@ type BuilderExport = { name: string; callee: string; scoped: boolean; why: strin
  * Per export, because the exposure is per export. `authorization` is declared on the builder call
  * one export made, and a caller filter is written in the handler one export runs, so neither says
  * anything about the other half of the file.
+ *
+ * The enumeration itself is `routeExports`, shared with `auth-boundary`, which had to be given the
+ * same per-export treatment a round later and wrote a second copy of this literal to get it.
  */
 function builderExports(ep: EntryPoint): BuilderExport[] {
-  const all = [
-    {
-      name: "loader",
-      callee: ep.loaderInitializerCallee,
-      authorization: ep.loaderBuilderOptions.includes("authorization"),
-      filters: ep.loaderScopesByCaller,
-    },
-    {
-      name: "action",
-      callee: ep.actionInitializerCallee,
-      authorization: ep.actionBuilderOptions.includes("authorization"),
-      filters: ep.actionScopesByCaller,
-    },
-  ];
-  return all
-    .filter((e) => e.callee !== null && BUILDERS.has(e.callee))
-    .map((e) => ({
-      name: e.name,
-      callee: e.callee!,
-      scoped: e.authorization || e.filters,
-      why: e.authorization ? "an authorization gate" : "a filter on the caller's identity",
-    }));
+  return routeExports(ep)
+    .filter((e) => e.initializerCallee !== null && BUILDERS.has(e.initializerCallee))
+    .map((e) => {
+      const authorization = e.builderOptions.includes("authorization");
+      return {
+        name: e.name,
+        callee: e.initializerCallee!,
+        scoped: authorization || e.scopesByCaller,
+        why: authorization ? "an authorization gate" : "a filter on the caller's identity",
+      };
+    });
 }
 
 /**

internal-packages/observability-map/src/checks/errorClassification.ts

@@ -118,13 +118,6 @@ function swallows(clause: CatchEvidence): boolean {
   return !decides(clause) && !inert(clause);
 }
 
-export function usesBuilder(ep: EntryPoint): boolean {
-  return (
-    (ep.loaderInitializerCallee !== null && BUILDERS.has(ep.loaderInitializerCallee)) ||
-    (ep.actionInitializerCallee !== null && BUILDERS.has(ep.actionInitializerCallee))
-  );
-}
-
 /**
  * Who decides what a failure means, and on what evidence.
  *