rules:
  - id: auth.fastify.cookie-session-secret
    languages:
      - javascript
      - typescript
    severity: ERROR
    message: |
      `@fastify/cookie`, `@fastify/session`, or `@fastify/secure-session` is
      registered with a hard-coded `secret` string literal. This key signs the
      session/cookie: anyone who reads it from your source or git history can
      forge signed cookies and impersonate any user.

      Load it from the environment
      (`fastify.register(fastifySession, { secret: process.env.SESSION_SECRET })`)
      or a secret manager, and add a placeholder to `.env.example`. The secret
      must be at least 32 characters. Rotate the leaked value out of source
      control.
    # Matches a Fastify plugin registration whose first argument is the cookie
    # or session plugin (identifier like `fastifyCookie`/`fastifySession` or
    # `require('@fastify/session')`, matched by the case-insensitive
    # cookie|session regex) and whose options carry a string literal `secret`.
    # The literal requirement excludes `process.env.*` reads; the allow-list
    # drops `${ENV}` templates, `<placeholders>`, and obvious stubs.
    # `paths.exclude` keeps it off test/example trees.
    patterns:
      - pattern: '$F.register($PLUGIN, { ..., secret: $S, ... })'
      - metavariable-regex:
          metavariable: $PLUGIN
          regex: (?i).*(cookie|session)
      - metavariable-pattern:
          metavariable: $S
          patterns:
            - pattern-regex: ^['"].*['"]$
            - pattern-not-regex: (?i)^['"]\$\{?[A-Za-z_]+\}?['"]$
            - pattern-not-regex: (?i)^['"]<[^'"]*>['"]$
            - pattern-not-regex: (?i)^['"](?:your[-_]|my[-_]|example|placeholder|xxx+|todo|fixme|test|dummy|fake|sample|changeme|change[-_]?me|redacted|replace)
    paths:
      exclude:
        - "**/test/**"
        - "**/__tests__/**"
        - "**/*.test.*"
        - "**/*.spec.*"
        - "**/example/**"
        - "**/examples/**"
        - "**/demo/**"
        - "**/benchmark/**"
        - "**/benchmarks/**"
        - "**/integration/**"
        - "**/*.tst.*"
    metadata:
      oauthlint-rule-id: AUTH-FASTIFY-002
      oauthlint-doc-url: https://oauthlint.dev/rules/fastify-cookie-session-secret
      category: security
      cwe: CWE-798
      owasp: A07:2021
      llm-prevalence: HIGH
      technology:
        - fastify
        - "@fastify/cookie"
        - "@fastify/session"
      references:
        - https://github.com/fastify/session#options
        - https://cwe.mitre.org/data/definitions/798.html