fix(audit): report the line of a raw sealed column name

Author: waleedlatif1

scripts/check-sealed-columns.test.ts

@@ -60,13 +60,13 @@ describe('check-sealed-columns', () => {
 
   it('flags physical column names in raw SQL outside tests and the backfill', () => {
     const source = [
-      `await db.execute(sql\`SELECT access_token FROM account WHERE id = \${id}\`)`,
+      `await db.execute(sql\`SELECT id FROM account WHERE id = \${id}\nAND access_token IS NULL\`)`,
       "sql.raw('refresh_token IS NULL')",
       `sql\`SELECT id FROM oauth_refresh_token WHERE grant = \${'refresh_token'}\``,
     ].join('\n')
     expect(found(source)).toEqual([
-      ['raw-column-name', 1],
       ['raw-column-name', 2],
+      ['raw-column-name', 3],
     ])
     expect(found(source, 'lib/file.integration.ts')).toEqual([])
     expect(found(source, 'packages/db/script-migrations/0037_seal_account_tokens.ts')).toEqual([])

scripts/check-sealed-columns.ts

@@ -143,12 +143,11 @@ export function findViolations(file: string, source: string, columns: SealedColu
   const names = new RegExp(`\\b(?:${columns.map((c) => escapeRegExp(c.columnName)).join('|')})\\b`)
   for (const pattern of [SQL_TEMPLATE, SQL_RAW]) {
     for (const match of source.matchAll(pattern)) {
-      const body = match[match.length - 1].replace(/\$\{[^}]*\}/g, (value) =>
-        ' '.repeat(value.length)
-      )
+      const capture = match[match.length - 1]
+      const bodyOffset = (match.index ?? 0) + match[0].lastIndexOf(capture)
+      const body = capture.replace(/\$\{[^}]*\}/g, (value) => ' '.repeat(value.length))
       const hit = names.exec(body)
-      if (hit)
-        report('raw-column-name', (match.index ?? 0) + match[0].indexOf(body) + hit.index, hit[0])
+      if (hit) report('raw-column-name', bodyOffset + hit.index, hit[0])
     }
   }
   return violations