rules:
  - id: auth.nextauth.debug-enabled
    languages:
      - javascript
      - typescript
    severity: WARNING
    message: |
      The NextAuth/Auth.js config hard-codes `debug: true`.

      Debug mode writes verbose diagnostics, including provider responses and
      token material, to the server logs, and leaving it on in production leaks
      that data to anyone who can read the logs. Gate it on the environment
      instead, for example `debug: process.env.NODE_ENV !== 'production'`, or
      remove the flag so it defaults to off.
    # Anchored to a NextAuth/Auth.js config object so an unrelated `debug: true`
    # (webpack, a logger, any options bag) never fires. We match only the
    # literal `true`; an env-gated value is a different AST and is left alone.
    patterns:
      - pattern: 'debug: true'
      - pattern-either:
          - pattern-inside: 'NextAuth({...})'
          - pattern-inside: 'NextAuth($A, {...})'
          - pattern-inside: 'NextAuth($A, $B, {...})'
          - pattern-inside: 'Auth($A, {...})'
          - pattern-inside: 'authOptions = {...}'
          - pattern-inside: 'authConfig = {...}'
          - pattern-inside: '$X: NextAuthOptions = {...}'
          - pattern-inside: '$X: NextAuthConfig = {...}'
          - pattern-inside: '$X: AuthOptions = {...}'
    # Keep the rule off test, example, and dev-playground trees, where demo
    # configs intentionally use these shapes; it still fires on its own fixtures
    # under rules/tests/fixtures/ (whose path has no such segment).
    paths:
      exclude:
        - "**/test/**"
        - "**/__tests__/**"
        - "**/*.test.*"
        - "**/*.spec.*"
        - "**/example/**"
        - "**/examples/**"
        - "**/demo/**"
        - "**/dev/**"
    metadata:
      oauthlint-rule-id: AUTH-NEXTAUTH-007
      oauthlint-doc-url: https://oauthlint.dev/rules/nextauth-debug-enabled
      category: security
      cwe: CWE-489
      owasp: A05:2021
      llm-prevalence: MEDIUM
      technology:
        - next-auth
      references:
        - https://authjs.dev/reference/core#debug
        - https://cwe.mitre.org/data/definitions/489.html