P3.7: Classifier — client storage hygiene findings

[bjcorder]

Parent tracker: #62
Spec: docs/superpowers/specs/2026-05-21-edge-case-hardening-design.md
Milestone: P3
Depends on: P3.6

Goal

Fire findings for tokens stored or transmitted via client-accessible channels.

Acceptance criteria

• token_in_local_storage fires when localStorage.setItem writes a token-shaped key.
• token_in_session_storage fires for sessionStorage.setItem.
• token_in_url_path_or_fragment fires for URL builders embedding token-shaped keys in path segments or fragment identifiers (not query params — those remain covered by the existing detector).
• client_secret_in_browser_code fires when a literal that looks like a client secret (or an identifier named client_secret, clientSecret) appears in a file path matching client-side heuristics (e.g., pages/, app/, src/components/, public/). Review-required since SessionScope cannot prove browser-only execution.
• Evidence-bound — each finding links the storage-call evidence.

New check IDs

• token_in_local_storage
• token_in_session_storage
• token_in_url_path_or_fragment
• client_secret_in_browser_code

Files touched

• crates/sessionscope-classifier/src/client_storage.rs (new)

Fixture expectations

• Negative variants for each check.
• Positive: tokens stored in HttpOnly cookies or in-memory only.
• False-positive: localStorage.setItem('theme', 'dark') — confirm no fire.

Audit-then-decide

• token_in_local_storage, token_in_session_storage: high_confidence_misconfiguration, severity high for literal token-shape keys.
• token_in_url_path_or_fragment: high_confidence_misconfiguration, severity high.
• client_secret_in_browser_code: dynamic_review_required, severity high (review-required because file-path heuristic).
• Feed into the consolidated P4.8 audit.

Doc-update checklist

• docs/USAGE.md check catalog: four new IDs.
• docs/COVERAGE_MATRIX.md: four rows.
• CHANGELOG.md unreleased entry.

[bjcorder]

Implemented in $(git rev-parse --short HEAD).

Summary:

• Added client_storage classifier rules for token_in_local_storage, token_in_session_storage, token_in_url_path_or_fragment, and client_secret_in_browser_code.
• Registered the classifier in the main classification pipeline.
• Preserved existing bearer browser-storage behavior while suppressing the legacy duplicate when new client-storage evidence exists at the same source location.
• Added focused classifier tests for all four new client-storage findings and bearer dedupe coverage through the existing bearer test target.

Validation:

• cargo test -q -p sessionscope-classifier client_storage — passed
• cargo test -q -p sessionscope-classifier bearer — passed

Notes / follow-ups:

• User-facing catalog and coverage matrix rows are consolidated in P3.10: Docs — P3 check catalog, OAuth/OIDC flow narrative, matrix rows #86 after all P3 check IDs are stable.

[bjcorder]

Correction: implemented in 98ffe39.

Summary:

• Added client_storage classifier rules for token_in_local_storage, token_in_session_storage, token_in_url_path_or_fragment, and client_secret_in_browser_code.
• Registered the classifier in the main classification pipeline.
• Preserved existing bearer browser-storage behavior while suppressing the legacy duplicate when new client-storage evidence exists at the same source location.
• Added focused classifier tests for all four new client-storage findings and bearer dedupe coverage through the existing bearer test target.

Validation:

• cargo test -q -p sessionscope-classifier client_storage — passed
• cargo test -q -p sessionscope-classifier bearer — passed

Notes / follow-ups:

• User-facing catalog and coverage matrix rows are consolidated in P3.10: Docs — P3 check catalog, OAuth/OIDC flow narrative, matrix rows #86 after all P3 check IDs are stable.

[bjcorder]

Implemented in follow-up commit $(git rev-parse --short HEAD).

Summary:

• Restored the test-only Evidence import required by the client storage classifier unit test after cleanup.

Validation:

• cargo test -q -p sessionscope-classifier client_storage — passed

Notes / follow-ups:

• None.

[bjcorder]

Correction: follow-up commit 9c222bf.

Summary:

• Restored the test-only Evidence import required by the client storage classifier unit test after cleanup.

Validation:

• cargo test -q -p sessionscope-classifier client_storage — passed

Notes / follow-ups:

• None.

[bjcorder]

Implemented in follow-up commit 071ef91.

Summary:

• Scoped the client storage classifier test import so normal library builds stay warning-free.

Validation:

• cargo test -q -p sessionscope-classifier client_storage — passed

Notes / follow-ups:

• None.

[bjcorder]

Implemented in validation-fix commit d966f7f.

Summary:

• Updated P3 classifier test setup to satisfy clippy field-reassign-with-default warnings.

Validation:

• cargo clippy --workspace --all-targets -- -D warnings — passed

Notes / follow-ups:

• None.

[bjcorder]

Implemented in PR #98: #98

Implementation commits:

• 98ffe39 — P3.7 client storage hygiene classifier
• 9c222bf — Restore client storage test import
• 071ef91 — Scope client storage test import
• d966f7f — Keep P3 classifier tests clippy-clean

Validation:

• cargo fmt --all -- --check — passed
• cargo check --workspace — passed
• cargo test -q — passed
• cargo clippy --workspace --all-targets -- -D warnings — passed

Closure status:

• This issue is ready to close when the PR is merged.

Remaining notes:

• None.