necropsy 0.2.0 → 0.3.0

data/lib/necropsy/entry_points/rails.rb

@@ -6,42 +6,49 @@ module Necropsy
   module EntryPoints
     class Rails
       ROUTE_VERBS = %w[get post put patch delete match].freeze
+      ROUTE_DSL_CALLS = %i[
+        collection concern concerns constraints controller defaults draw member mount namespace resource resources root scope
+      ].to_set.merge(ROUTE_VERBS.map(&:to_sym)).freeze
       RESTFUL_ACTIONS = %w[index show new create edit update destroy].freeze
       SINGULAR_ACTIONS = %w[show new create edit update destroy].freeze
       IRREGULAR_PLURALS = { 'person' => 'people', 'man' => 'men', 'woman' => 'women', 'child' => 'children' }.freeze
+      INFLECTION_RULES_AFFECTING_PLURALIZATION = %i[clear plural].freeze
       RouteContext = Struct.new(:modules, :resource, :controller, keyword_init: true)
 
       def apply(graph, project)
-        return unless project.config.rails_enabled?
+        return unless project.config.rails_enabled?(reference_files: project.reference_files)
+
+        @route_blockers = []
+        load_inflections(project)
 
         referenced_view_methods = view_method_names(project)
         graph.method_nodes.each do |node|
           case node.file
           when %r{\Aapp/jobs/}
-            graph.add_entry_point(node.id, :job_perform) if node.name == 'perform'
+            graph.add_entry_point(node.graph_id, :job_perform) if node.name == 'perform'
           when %r{\Aapp/mailers/}
             if node.kind == :instance_method && node.visibility == :public
-              graph.add_entry_point(node.id,
+              graph.add_entry_point(node.graph_id,
                                     :mailer_action)
             end
           when %r{\Aapp/helpers/}
-            graph.add_entry_point(node.id, :rails_view_helper) if referenced_view_methods.include?(node.name)
+            graph.add_entry_point(node.graph_id, :rails_view_helper) if referenced_view_methods.include?(node.name)
           when %r{\Aapp/components/}
-            graph.add_entry_point(node.id, :rails_component) if component_entrypoint?(node)
+            graph.add_entry_point(node.graph_id, :rails_component) if component_entrypoint?(node)
           when %r{\Adb/migrate/}
-            graph.add_entry_point(node.id, :rails_migration) if %w[change up down].include?(node.name)
+            graph.add_entry_point(node.graph_id, :rails_migration) if %w[change up down].include?(node.name)
           end
 
           if node.file.start_with?('app/') && !node.file.start_with?('app/helpers/', 'app/components/') &&
              referenced_view_methods.include?(node.name)
-            graph.add_entry_point(node.id, :rails_view_reference)
+            graph.add_entry_point(node.graph_id, :rails_view_reference)
           end
         end
 
         graph.nodes.values.select do |node|
           node.kind == :block_entry && node.file.start_with?('config/initializers/')
         end.each do |node|
-          graph.add_entry_point(node.id, :callback_registered)
+          graph.add_entry_point(node.graph_id, :callback_registered)
         end
 
         route_entry_points(project).each do |node_id|
@@ -49,52 +56,176 @@ module Necropsy
             graph.add_entry_point(matching_id, :rails_route)
           end
         end
+        @route_blockers.each { |blocker| graph.add_blocker(blocker) }
       end
 
       private
 
+      def load_inflections(project)
+        @irregular_plurals = IRREGULAR_PLURALS.dup
+        @acronyms = {}
+        @uncountables = Set.new
+        path = project.reference_files.find do |candidate|
+          project.relative_path(candidate) == 'config/initializers/inflections.rb'
+        end
+        return unless path
+
+        source = File.read(path)
+        result = Prism.parse(source)
+        unless result.success?
+          @route_blockers << route_health_blocker(
+            project.relative_path(path), result.errors.first&.location&.start_line,
+            'Rails inflections could not be parsed'
+          )
+          return
+        end
+
+        inflection_blocks(result.value).each do |block, parameter_name|
+          each_call(block.body) do |call|
+            next unless call.receiver.is_a?(Prism::LocalVariableReadNode)
+            next unless call.receiver.name == parameter_name
+
+            case call.name
+            when :irregular then register_irregular(call, project.relative_path(path))
+            when :acronym then register_acronym(call, project.relative_path(path))
+            when :uncountable then register_uncountable(call, project.relative_path(path))
+            when *INFLECTION_RULES_AFFECTING_PLURALIZATION
+              @route_blockers << route_health_blocker(
+                project.relative_path(path), call.location.start_line,
+                "Rails #{call.name} inflection cannot be evaluated statically"
+              )
+            end
+          end
+        end
+      rescue SystemCallError, EncodingError => e
+        @route_blockers << route_health_blocker(
+          'config/initializers/inflections.rb', 1, "Rails inflections could not be read: #{e.class}"
+        )
+      end
+
+      def each_call(root)
+        pending = [root]
+        until pending.empty?
+          node = pending.pop
+          yield node if node.is_a?(Prism::CallNode)
+          pending.concat(node.child_nodes.compact)
+        end
+      end
+
+      def inflection_blocks(root)
+        blocks = []
+        each_call(root) do |call|
+          next unless call.name == :inflections && constant_name(call.receiver) == 'ActiveSupport::Inflector'
+          next unless call.block
+
+          parameter = required_block_parameter(call.block)
+          unless parameter.respond_to?(:name)
+            @route_blockers << route_health_blocker(
+              'config/initializers/inflections.rb', call.location.start_line,
+              'Rails inflections block has no static block parameter'
+            )
+            next
+          end
+          blocks << [call.block, parameter.name]
+        end
+        blocks
+      end
+
+      def required_block_parameter(block)
+        block_parameters = block.parameters
+        parameters = block_parameters.parameters if block_parameters
+        Array(parameters&.requireds).first
+      end
+
+      def register_irregular(call, path)
+        singular, plural = Array(call.arguments&.arguments).first(2).map { |node| literal_route_argument(node) }
+        return @irregular_plurals[singular] = plural if singular && plural
+
+        @route_blockers << route_health_blocker(path, call.location.start_line, 'Rails irregular inflection is dynamic')
+      end
+
+      def register_acronym(call, path)
+        value = literal_route_argument(Array(call.arguments&.arguments).first)
+        return @acronyms[value.downcase] = value if value
+
+        @route_blockers << route_health_blocker(path, call.location.start_line, 'Rails acronym inflection is dynamic')
+      end
+
+      def register_uncountable(call, path)
+        words = Array(call.arguments&.arguments).flat_map do |argument|
+          if argument.is_a?(Prism::ArrayNode) && !argument.contains_splat?
+            argument.elements.map { |element| literal_route_argument(element) }
+          else
+            literal_route_argument(argument)
+          end
+        end
+        if words.any? && words.none?(&:nil?)
+          @uncountables.merge(words)
+          return
+        end
+
+        @route_blockers << route_health_blocker(path, call.location.start_line, 'Rails uncountable inflection is dynamic')
+      end
+
       def route_entry_points(project)
         routes = File.join(project.root, 'config/routes.rb')
-        parse_route_file(project.root, routes, seen: {}, concerns: {})
+        parse_route_file(project, routes, seen: {}, concerns: {})
       end
 
-      def parse_route_file(root, path, seen:, concerns:)
-        expanded = File.expand_path(path, root)
-        return [] unless File.exist?(expanded)
+      def parse_route_file(project, path, seen:, concerns:)
+        previous_route_path = @current_route_path
+        expanded = File.expand_path(path, project.root)
+        return [] unless project.reference_file?(expanded)
         return [] if seen[expanded]
 
         seen[expanded] = true
+        @current_route_path = project.relative_path(expanded)
         source = File.read(expanded)
         result = Prism.parse(source)
-        return [] if result.failure?
+        if result.failure?
+          @route_blockers << route_health_blocker(
+            @current_route_path, result.errors.first&.location&.start_line, 'routes.rb could not be parsed'
+          )
+          return []
+        end
 
         parse_route_statements(
           result.value.statements,
           source: source,
-          root: root,
+          project: project,
           seen: seen,
           concerns: concerns,
           context: RouteContext.new(modules: [], resource: nil)
         )
-      rescue SystemCallError, EncodingError
+      rescue SystemCallError, EncodingError => e
+        @route_blockers << route_health_blocker(
+          @current_route_path || project.relative_path(expanded), 1,
+          "route source could not be read: #{e.class}"
+        )
         []
+      ensure
+        @current_route_path = previous_route_path
       end
 
-      def parse_route_statements(statements, source:, root:, seen:, concerns:, context:)
+      def parse_route_statements(statements, source:, project:, seen:, concerns:, context:)
         Array(statements&.body).flat_map do |statement|
-          parse_route_statement(statement, source: source, root: root, seen: seen, concerns: concerns,
+          parse_route_statement(statement, source: source, project: project, seen: seen, concerns: concerns,
                                            context: context)
         end.compact.uniq
       end
 
-      def parse_route_statement(statement, source:, root:, seen:, concerns:, context:)
+      def parse_route_statement(statement, source:, project:, seen:, concerns:, context:)
         unless statement.is_a?(Prism::CallNode)
           return statement.child_nodes.compact.flat_map do |child|
-            parse_route_statement(child, source: source, root: root, seen: seen, concerns: concerns, context: context)
+            parse_route_statement(child, source: source, project: project, seen: seen, concerns: concerns,
+                                         context: context)
           end
         end
 
+        return [] unless ROUTE_DSL_CALLS.include?(statement.name)
+
         call_source = route_call_source(statement, source)
+        record_dynamic_route(statement, context) if dynamic_route_statement?(statement)
         if statement.name == :concern && statement.block
           name = literal_route_argument(statement.arguments&.arguments&.first)
           concerns[name] = [statement.block.body, source] if name
@@ -102,8 +233,8 @@ module Necropsy
         end
 
         targets = route_targets(call_source, context)
-        targets.concat(route_file_targets(call_source, root, seen, concerns))
-        targets.concat(concern_targets(call_source, context, root, seen, concerns))
+        targets.concat(route_file_targets(call_source, project, seen, concerns))
+        targets.concat(concern_targets(call_source, context, project, seen, concerns))
         return targets unless statement.block
 
         child_context = nested_route_context(call_source, context)
@@ -111,7 +242,7 @@ module Necropsy
           parse_route_statements(
             statement.block.body,
             source: source,
-            root: root,
+            project: project,
             seen: seen,
             concerns: concerns,
             context: child_context
@@ -130,6 +261,119 @@ module Necropsy
         node.unescaped.to_s
       end
 
+      def dynamic_route_statement?(node)
+        return false unless ROUTE_VERBS.include?(node.name.to_s) ||
+                            %i[root resources resource mount namespace scope controller].include?(node.name)
+
+        Array(node.arguments&.arguments).each_with_index.any? do |argument, index|
+          !literal_route_value?(argument) && !static_mount_target?(node, argument, index)
+        end
+      end
+
+      def static_mount_target?(statement, argument, index)
+        statement.name == :mount && index.zero? && !constant_name(argument).nil?
+      end
+
+      def constant_name(node)
+        case node
+        when Prism::ConstantReadNode
+          node.name.to_s
+        when Prism::ConstantPathNode
+          parent = node.parent ? constant_name(node.parent) : nil
+          [parent, node.name.to_s].compact.join('::')
+        end
+      end
+
+      def literal_route_value?(node)
+        case node
+        when Prism::SymbolNode, Prism::StringNode, Prism::IntegerNode, Prism::TrueNode, Prism::FalseNode,
+             Prism::NilNode
+          true
+        when Prism::KeywordHashNode, Prism::HashNode
+          Array(node.elements).all? do |element|
+            element.is_a?(Prism::AssocNode) && literal_route_value?(element.value)
+          end
+        when Prism::ArrayNode
+          !node.contains_splat? && node.elements.all? { |element| literal_route_value?(element) }
+        else
+          false
+        end
+      end
+
+      def record_dynamic_route(statement, context)
+        arguments = Array(statement.arguments&.arguments)
+        dynamic = arguments.find { |argument| !literal_route_value?(argument) }
+        return unless dynamic
+
+        scope_kind, scope_value = dynamic_route_scope(statement, context)
+        @route_blockers << route_blocker(
+          @current_route_path,
+          statement.location.start_line,
+          "dynamic route argument for #{statement.name}",
+          scope_kind: scope_kind,
+          scope_value: scope_value
+        )
+      end
+
+      def dynamic_route_scope(statement, context)
+        controller = literal_route_option(statement, 'controller')
+        controller ||= context.controller || context.resource
+        if controller
+          owner = "#{camelize(route_controller(context, controller))}Controller"
+          return [:owner, owner]
+        end
+
+        action = literal_route_option(statement, 'action')
+        return [:message, action] if action
+        return [:namespace, camelize(context.modules.join('/'))] if context.modules.any?
+
+        [:global, '*']
+      end
+
+      def literal_route_option(statement, name)
+        hash = Array(statement.arguments&.arguments).find do |argument|
+          argument.is_a?(Prism::KeywordHashNode) || argument.is_a?(Prism::HashNode)
+        end
+        pair = Array(hash&.elements).find do |element|
+          element.is_a?(Prism::AssocNode) && literal_route_argument(element.key) == name
+        end
+        literal_route_argument(pair&.value)
+      end
+
+      def route_blocker(path, line, reason, scope_kind:, scope_value:)
+        Blocker.new(
+          kind: :rails_route_dynamic,
+          scope_kind: scope_kind,
+          scope_value: scope_value,
+          source: :rails_rule,
+          reason: reason,
+          suggested_action: :review_dynamic_route,
+          metadata: {
+            'caller_domain' => 'runtime',
+            'rule_id' => 'rails.route',
+            'file' => path,
+            'line' => line
+          }.compact
+        )
+      end
+
+      def route_health_blocker(path, line, reason)
+        Blocker.new(
+          kind: :rails_route_health,
+          scope_kind: :global,
+          scope_value: '*',
+          source: :rails_rule,
+          reason: reason,
+          suggested_action: :fix_route_source,
+          metadata: {
+            'caller_domain' => 'runtime',
+            'rule_id' => 'rails.route.health',
+            'file' => path,
+            'line' => line
+          }.compact
+        )
+      end
+
       def nested_route_context(line, context)
         contexts = [context]
         push_context(contexts, line, context)
@@ -207,13 +451,18 @@ module Necropsy
         end
       end
 
-      def route_file_targets(line, root, seen, concerns)
+      def route_file_targets(line, project, seen, concerns)
         return [] unless (match = line.match(/\bdraw\s+:?["']?([a-zA-Z_]\w*)/))
 
-        parse_route_file(root, File.join(root, "config/routes/#{match[1]}.rb"), seen: seen, concerns: concerns)
+        parse_route_file(
+          project,
+          File.join(project.root, "config/routes/#{match[1]}.rb"),
+          seen: seen,
+          concerns: concerns
+        )
       end
 
-      def concern_targets(line, context, root, seen, concerns)
+      def concern_targets(line, context, project, seen, concerns)
         target_context = concern_context(line, context)
         concern_names(line).flat_map do |name|
           statements, source = concerns[name]
@@ -222,7 +471,7 @@ module Necropsy
           parse_route_statements(
             statements,
             source: source,
-            root: root,
+            project: project,
             seen: seen,
             concerns: concerns,
             context: target_context
@@ -288,22 +537,42 @@ module Necropsy
       end
 
       def controller_action_target(line, context)
-        controller = line[%r{\bcontroller:\s+:?["']?([a-zA-Z_][\w/]*)}, 1]
-        action = line[/\baction:\s+:?["']?([a-zA-Z_]\w*)/, 1]
+        controller = literal_source_option(line, 'controller', allow_path: true)
+        action = literal_source_option(line, 'action')
         controller ||= context.controller
         return nil unless controller && action
 
         controller_action_id(route_controller(context, controller), action)
       end
 
+      def literal_source_option(line, name, allow_path: false)
+        value_pattern = allow_path ? '[a-zA-Z_][\\w/]*' : '[a-zA-Z_]\\w*'
+        match = line.match(/\b#{Regexp.escape(name)}:\s*(?::(#{value_pattern})|["'](#{value_pattern})["'])/)
+        match && (match[1] || match[2])
+      end
+
       def mounted_engine_targets(engine_name)
         ["#{engine_name}.call", "#{engine_name}#call"]
       end
 
       def pluralize(name)
-        return IRREGULAR_PLURALS.fetch(name) if IRREGULAR_PLURALS.key?(name)
-        return "#{name}es" if name.end_with?('s', 'x', 'z', 'ch', 'sh')
-        return "#{name.delete_suffix('y')}ies" if name.match?(/[^aeiou]y\z/)
+        irregular = @irregular_plurals || IRREGULAR_PLURALS
+        return irregular.fetch(name) if irregular.key?(name)
+        return name if @uncountables&.include?(name)
+        return name.sub(/(quiz)\z/i, '\\1zes') if name.match?(/quiz\z/i)
+        return name.sub(/^(ox)\z/i, '\\1en') if name.match?(/^ox\z/i)
+        return name.sub(/([ml])ouse\z/i, '\\1ice') if name.match?(/([ml])ouse\z/i)
+        return name.sub(/(matr|vert|ind)(?:ix|ex)\z/i, '\\1ices') if name.match?(/(matr|vert|ind)(?:ix|ex)\z/i)
+        return name.sub(/(x|ch|ss|sh)\z/i, '\\1es') if name.match?(/(x|ch|ss|sh)\z/i)
+        return name.sub(/([^aeiouy]|qu)y\z/i, '\\1ies') if name.match?(/([^aeiouy]|qu)y\z/i)
+        return name.sub(/(?:([^f])fe|([lr])f)\z/i, '\\1\\2ves') if name.match?(/(?:([^f])fe|([lr])f)\z/i)
+        return name.sub(/sis\z/i, 'ses') if name.match?(/sis\z/i)
+        return name.sub(/([ti])um\z/i, '\\1a') if name.match?(/([ti])um\z/i)
+        return name.sub(/(buffal|tomat)o\z/i, '\\1oes') if name.match?(/(buffal|tomat)o\z/i)
+        return name.sub(/(alias|status)\z/i, '\\1es') if name.match?(/(alias|status)\z/i)
+        return name.sub(/(octop|vir)us\z/i, '\\1i') if name.match?(/(octop|vir)us\z/i)
+        return name.sub(/^(ax|test)is\z/i, '\\1es') if name.match?(/^(ax|test)is\z/i)
+        return name if name.end_with?('s')
 
         "#{name}s"
       end
@@ -313,16 +582,18 @@ module Necropsy
       end
 
       def matching_route_nodes(graph, node_id)
-        return [node_id] if graph.nodes.key?(node_id)
+        exact = graph.definitions_for(node_id)
+        return exact.select { |node| node.visibility == :public }.map(&:graph_id) unless exact.empty?
         return [] unless node_id.include?('Controller#')
 
         controller, action = node_id.split('#', 2)
         expected_file = "app/controllers/#{underscore(controller.delete_suffix('Controller'))}_controller.rb"
         graph.method_nodes.filter_map do |node|
           next unless node.name == action && node.owner&.end_with?(controller)
+          next unless node.visibility == :public
           next unless node.file == expected_file
 
-          node.id
+          node.graph_id
         end
       end
 
@@ -331,21 +602,28 @@ module Necropsy
       end
 
       def view_files(project)
-        Dir.glob(File.join(project.root, '{app/views,app/components}/**/*')).select { |path| File.file?(path) }
+        project.reference_files.select do |path|
+          project.relative_path(path).start_with?('app/views/', 'app/components/')
+        end
       end
 
       def view_source(path)
-        File.read(path)
-            .gsub(/<%#.*?%>/m, '')
-            .gsub(/<!--.*?-->/m, '')
-            .lines.reject { |line| line.strip.start_with?('-#') }.join
+        source = File.read(path)
+        return EmbeddedRuby.extract(source) if File.extname(path).downcase == '.erb'
+
+        source.gsub(/<!--.*?-->/m, '').lines.reject { |line| line.strip.start_with?('-#') }.join
       end
 
       def view_method_names(project)
         @view_method_names ||= {}
         @view_method_names[project.root] ||= view_files(project).each_with_object(Set.new) do |path, names|
-          view_source(path).scan(/(?<![A-Za-z0-9_])([a-zA-Z_]\w*[!?=]?)(?![A-Za-z0-9_])/).each do |match|
-            names << match.first
+          source = File.read(path)
+          if File.extname(path).downcase == '.erb'
+            names.merge(EmbeddedRuby.call_names(source))
+          else
+            view_source(path).scan(/(?<![A-Za-z0-9_])([a-zA-Z_]\w*[!?=]?)(?![A-Za-z0-9_])/).each do |match|
+              names << match.first
+            end
           end
         rescue SystemCallError, EncodingError
           next
@@ -357,7 +635,10 @@ module Necropsy
       end
 
       def camelize(path)
-        path.split('/').map { |part| part.split('_').map(&:capitalize).join }.join('::')
+        acronyms = @acronyms || {}
+        path.split('/').map do |part|
+          part.split('_').map { |word| acronyms.fetch(word.downcase, word.capitalize) }.join
+        end.join('::')
       end
 
       def underscore(constant)

data/lib/necropsy/entry_points/test.rb

@@ -5,7 +5,12 @@ module Necropsy
     class Test
       def apply(graph, _project)
         graph.nodes.values.select { |node| node.kind == :block_entry && node.test }.each do |node|
-          graph.add_entry_point(node.id, :test_suite)
+          graph.add_entry_point(
+            node.graph_id,
+            :test_suite,
+            domain: :test,
+            evidence: { 'type' => 'test_file', 'file' => node.file }
+          )
         end
       end
     end