rigortype 0.1.10 → 0.1.12

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack/controller_discoverer.rb

@@ -0,0 +1,201 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "controller_index"
+
+module Rigor
+  module Plugin
+    class Actionpack < Rigor::Plugin::Base
+      # Walks `controller_search_paths` building a
+      # {ControllerIndex} of `(class_name, methods,
+      # parent_class_name)` triples. Used by Phase 2 (filter
+      # chains) to validate that `before_action :name`
+      # references a method defined on the controller or its
+      # ancestor chain.
+      #
+      # Two declaration shapes are recognised and qualified
+      # the same way:
+      #
+      #   class Admin::AccountsController < BaseController
+      #     # → registered as "Admin::AccountsController"
+      #
+      #   module Admin
+      #     class AccountsController < BaseController
+      #       # → ALSO registered as "Admin::AccountsController"
+      #     end
+      #   end
+      #
+      # Pre-fix the nested form ignored the enclosing `module
+      # Admin` and registered the inner class as bare
+      # `"AccountsController"`, overwriting the top-level
+      # `app/controllers/accounts_controller.rb` entry. Mastodon
+      # has both shapes for the same logical name (top-level
+      # `AccountsController` + `Admin::AccountsController` +
+      # `Api::V1::AccountsController`) and the overwrite caused
+      # the wrong inheritance / method set to flow downstream,
+      # producing dozens of false `unknown-filter-method`
+      # diagnostics.
+      #
+      # Multi-level inheritance is also walked: `Admin::AccountsController
+      # < BaseController < ApplicationController` resolves
+      # methods from all three. Cycle-safe via a visited set.
+      # The parent-name lookup is **lexically scoped** — a bare
+      # `BaseController` reference inside `module Admin` first
+      # tries `Admin::BaseController`, then falls through to
+      # top-level `BaseController`, matching Ruby's constant-
+      # resolution semantics.
+      class ControllerDiscoverer
+        def initialize(io_boundary:, search_paths:)
+          @io_boundary = io_boundary
+          @search_paths = search_paths
+        end
+
+        # @return [ControllerIndex]
+        def discover
+          entries = {}
+          ruby_files_under(@search_paths).each do |path|
+            harvest(path, entries)
+          end
+          ControllerIndex.new(entries.freeze)
+        end
+
+        private
+
+        def ruby_files_under(roots)
+          roots.flat_map do |root|
+            absolute = File.expand_path(root)
+            next [] unless File.directory?(absolute)
+
+            Dir.glob(File.join(absolute, "**", "*.rb"))
+          end
+        end
+
+        def harvest(path, entries)
+          contents = @io_boundary.read_file(path)
+          parse_result = Prism.parse(contents)
+          return unless parse_result.errors.empty?
+
+          walk_declarations(parse_result.value, namespace: []) do |declaration_node, enclosing|
+            entry = build_entry(declaration_node, enclosing)
+            entries[entry.class_name] = entry if entry.class_name
+          end
+        rescue Plugin::AccessDeniedError, Errno::ENOENT
+          nil
+        end
+
+        # Walks every `ClassNode` / `ModuleNode` in the AST,
+        # yielding `[declaration_node, enclosing_namespace_array]`
+        # for each. `enclosing` is the chain of module / class
+        # qualifiers OUTSIDE the yielded declaration (e.g. for
+        # `module Admin; class AccountsController; end; end`
+        # the inner class yields with enclosing
+        # `["Admin"]`). The yielded declaration's own segment
+        # is added to the chain for its body's recursion so
+        # constants nested two levels deep qualify correctly.
+        def walk_declarations(node, namespace:, &)
+          return unless node.is_a?(Prism::Node)
+
+          if node.is_a?(Prism::ClassNode) || node.is_a?(Prism::ModuleNode)
+            yield node, namespace
+            inner_namespace = namespace + namespace_segments_for(node)
+            return if node.body.nil?
+
+            walk_declarations(node.body, namespace: inner_namespace, &)
+          else
+            node.compact_child_nodes.each do |child|
+              walk_declarations(child, namespace: namespace, &)
+            end
+          end
+        end
+
+        # The segments contributed by a declaration to the
+        # qualifier chain of its body. For `class A::B` this is
+        # `["A", "B"]`; for `module Outer` it is `["Outer"]`.
+        # Returns `[]` for an anonymous declaration the walker
+        # cannot qualify.
+        def namespace_segments_for(declaration_node)
+          path = qualified_name_for(declaration_node.constant_path)
+          path ? path.split("::") : []
+        end
+
+        def build_entry(declaration_node, enclosing)
+          name = qualified_name_with_enclosing(declaration_node.constant_path, enclosing)
+          parent_name = parent_name_for(declaration_node)
+          methods = collect_def_names(declaration_node.body)
+          includes = collect_include_targets(declaration_node.body)
+          ControllerIndex::Entry.new(
+            class_name: name,
+            defined_methods: methods.freeze,
+            parent_class_name: parent_name,
+            included_module_names: includes.freeze,
+            enclosing_namespace: enclosing.dup.freeze
+          )
+        end
+
+        # Resolves the declared name against the enclosing
+        # namespace chain. A `ConstantPathNode` (e.g.
+        # `Admin::Foo` in `class Admin::Foo`) is already
+        # absolute and ignores the enclosing chain. A
+        # `ConstantReadNode` (bare `Foo` in `module Admin;
+        # class Foo`) is qualified against the chain so the
+        # name becomes `Admin::Foo`.
+        def qualified_name_with_enclosing(node, enclosing)
+          return nil unless node.is_a?(Prism::Node)
+
+          local = qualified_name_for(node)
+          return nil if local.nil?
+          return local if node.is_a?(Prism::ConstantPathNode) && !node.parent.nil?
+          return local if enclosing.empty?
+
+          "#{enclosing.join('::')}::#{local}"
+        end
+
+        def parent_name_for(declaration_node)
+          return nil unless declaration_node.is_a?(Prism::ClassNode) && declaration_node.superclass
+
+          qualified_name_for(declaration_node.superclass)
+        end
+
+        def collect_def_names(node, accumulator = [])
+          return accumulator unless node.is_a?(Prism::Node)
+
+          accumulator << node.name if node.is_a?(Prism::DefNode) && node.receiver.nil?
+          node.compact_child_nodes.each { |child| collect_def_names(child, accumulator) }
+          accumulator
+        end
+
+        # Collects the qualified-constant targets passed to
+        # `include` calls inside the body. Stops at nested
+        # `ClassNode` / `ModuleNode` boundaries so a class
+        # declared inside a concern doesn't pull the concern's
+        # includes into itself.
+        def collect_include_targets(node, accumulator = [])
+          return accumulator unless node.is_a?(Prism::Node)
+          return accumulator if node.is_a?(Prism::ClassNode) || node.is_a?(Prism::ModuleNode)
+
+          if node.is_a?(Prism::CallNode) && node.receiver.nil? && node.name == :include
+            (node.arguments&.arguments || []).each do |arg|
+              name = qualified_name_for(arg)
+              accumulator << name if name
+            end
+          end
+
+          node.compact_child_nodes.each { |child| collect_include_targets(child, accumulator) }
+          accumulator
+        end
+
+        def qualified_name_for(node)
+          case node
+          when Prism::ConstantReadNode then node.name.to_s
+          when Prism::ConstantPathNode
+            parent = node.parent.nil? ? nil : qualified_name_for(node.parent)
+            return nil if !node.parent.nil? && parent.nil?
+
+            parent.nil? ? node.name.to_s : "#{parent}::#{node.name}"
+          end
+        end
+      end
+    end
+  end
+end

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack/controller_index.rb

@@ -0,0 +1,226 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Plugin
+    class Actionpack < Rigor::Plugin::Base
+      # Per-run frozen index of discovered controllers AND
+      # concerns (modules) in `controller_search_paths`. Phase 2
+      # (filter-chain validation) consults the index at every
+      # call site to check that `before_action :name` references
+      # a method that actually exists on the controller, its
+      # parent (one level of inheritance), or any module the
+      # controller or its ancestor chain transitively `include`s.
+      #
+      # Real-world example (Mastodon):
+      #   AccountsController < ApplicationController
+      #     include SignatureAuthentication      # local concern
+      #   SignatureAuthentication < module
+      #     include SignatureVerification         # local concern
+      #   SignatureVerification < module
+      #     def require_account_signature!        # ← the filter target
+      #
+      # The include chain spans three concern modules.
+      # `effective_methods_for("AccountsController")` walks all
+      # of them transitively to collect `require_account_signature!`.
+      class ControllerIndex
+        # `defined_methods` carries the discovered method names
+        # (Symbols). `included_module_names` carries the constant
+        # names passed to `include X` calls inside the
+        # class / module body (Strings). `parent_class_name` is
+        # the immediate superclass (nil for plain modules).
+        # `enclosing_namespace` is the qualifier chain of the
+        # declaration's *lexical* enclosing scope (e.g.
+        # `["Admin"]` for an `Admin::Foo` declared via
+        # `module Admin; class Foo; end; end`). Used by the
+        # index's parent / module lookup to try lexically-scoped
+        # constant resolution before falling through to the
+        # top-level form — Ruby's constant lookup walks the
+        # enclosing scope chain before `Object`.
+        Entry = Data.define(:class_name, :defined_methods, :parent_class_name, :included_module_names,
+                            :enclosing_namespace)
+
+        attr_reader :entries
+
+        def initialize(entries)
+          @entries = entries.freeze
+          freeze
+        end
+
+        # @return [Entry, nil]
+        def find(class_name)
+          @entries[class_name]
+        end
+
+        # Resolves the **effective** method set for a controller,
+        # including methods contributed by every module the
+        # controller / any ancestor transitively `include`s AND
+        # methods inherited from the ancestor chain (unbounded
+        # depth, cycle-safe via a visited set).
+        #
+        # Parent / module lookups are **lexically scoped** — a
+        # bare `BaseController` reference inside `module Admin`
+        # first tries `Admin::BaseController`, then falls
+        # through to the top-level `BaseController`. Matches
+        # Ruby's constant-resolution semantics. Without this an
+        # `Admin::Foo < BaseController` declaration would
+        # incorrectly walk the top-level `BaseController` even
+        # when an `Admin::BaseController` exists.
+        def effective_methods_for(class_name)
+          seen_classes = {}
+          seen_modules = {}
+          methods = []
+          current = class_name
+          while current && !seen_classes[current]
+            seen_classes[current] = true
+            entry = @entries[current]
+            break if entry.nil?
+
+            methods.concat(entry.defined_methods)
+            entry.included_module_names.each do |included|
+              resolved_include = resolve_constant_lexically(included, entry.enclosing_namespace)
+              collect_methods(resolved_include, seen_modules, methods)
+            end
+            next_parent = entry.parent_class_name
+            # Same self-reference guard as `unresolved_include?`:
+            # `class ActivityPub::ApplicationController <
+            # ::ApplicationController` lexically resolves
+            # `ApplicationController` to itself; fall back to
+            # the unprefixed top-level name in that case.
+            current = if next_parent
+                        resolved = resolve_constant_lexically(next_parent, entry.enclosing_namespace)
+                        resolved == current ? next_parent.sub(/\A::/, "") : resolved
+                      end
+          end
+          methods.uniq.freeze
+        end
+
+        # @return [Boolean] true when the class has at least one
+        #   include OR parent class we couldn't resolve in the
+        #   index (typically a gem-shipped concern such as Devise's
+        #   `Devise::Controllers::Helpers`, or a gem-shipped
+        #   parent controller such as `Devise::ConfirmationsController`
+        #   or `Doorkeeper::AuthorizedApplicationsController`).
+        #   Phase 2 uses this to downgrade `unknown-filter-method`
+        #   to silence — the unresolved module / parent may
+        #   legitimately contribute the filter (either directly,
+        #   or via its own ancestor chain which the static
+        #   analyzer cannot follow), and there's no way to verify.
+        def unresolved_include?(class_name)
+          entry = @entries[class_name]
+          return false if entry.nil?
+
+          # Walk the full ancestor chain. `Admin::Foo <
+          # BaseController < ApplicationController` should report
+          # an unresolved include if ANY of the three references
+          # a gem-shipped concern OR a gem-shipped parent class
+          # we cannot index. The first iteration's `current_entry`
+          # is always resolved (caller verified `known?`); a nil
+          # `current_entry` on a subsequent iteration means the
+          # AST-side `< Parent` reached a gem-shipped class
+          # whose ancestor methods are invisible to us.
+          seen_classes = {}
+          current = class_name
+          first = true
+          while current && !seen_classes[current]
+            seen_classes[current] = true
+            current_entry = @entries[current]
+            if current_entry.nil?
+              return true unless first
+
+              break
+            end
+            first = false
+
+            current_entry.included_module_names.each do |included|
+              resolved = resolve_constant_lexically(included, current_entry.enclosing_namespace)
+              return true if resolved.nil? || !@entries.key?(resolved)
+            end
+            next_parent = current_entry.parent_class_name
+            # Avoid lexically resolving to ourselves. `class
+            # ActivityPub::ApplicationController < ::ApplicationController`
+            # would otherwise resolve `ApplicationController` (in
+            # the lexical scope `["ActivityPub"]`) to
+            # `ActivityPub::ApplicationController` and short-
+            # circuit the walk before reaching the top-level
+            # parent. When the lexical match is the current
+            # class itself, fall back to the unprefixed
+            # top-level name.
+            current = if next_parent
+                        resolved = resolve_constant_lexically(next_parent, current_entry.enclosing_namespace)
+                        resolved == current ? next_parent.sub(/\A::/, "") : resolved
+                      end
+          end
+          false
+        end
+
+        def empty?
+          @entries.empty?
+        end
+
+        def known?(class_name)
+          @entries.key?(class_name)
+        end
+
+        def class_names
+          @entries.keys
+        end
+
+        private
+
+        def collect_methods(name, seen, into)
+          return if name.nil?
+
+          entry = @entries[name]
+          return if entry.nil? || seen[name]
+
+          seen[name] = true
+          into.concat(entry.defined_methods)
+          entry.included_module_names.each do |included|
+            resolved = resolve_constant_lexically(included, entry.enclosing_namespace)
+            collect_methods(resolved, seen, into)
+          end
+        end
+
+        # Ruby's constant-lookup walk: a bare constant name
+        # inside `module Admin` first tries `Admin::Const`,
+        # then walks outward, and finally falls through to
+        # top-level `Const`. We approximate that by trying
+        # the candidate `enclosing + name` chains from
+        # deepest to shallowest, and returning the first
+        # candidate that has an entry in the index. When
+        # nothing resolves, return the original name
+        # unchanged — the caller treats unresolved entries as
+        # "gem-shipped concerns we cannot see" (the
+        # `unresolved_include?` predicate).
+        #
+        # `name` may already be qualified (`Foo::Bar`); we
+        # only try lexical prefixing when the unqualified
+        # first segment doesn't match a top-level entry.
+        def resolve_constant_lexically(name, enclosing)
+          return nil if name.nil?
+
+          # A leading `::` denotes the top-level constant
+          # explicitly (`< ::ApplicationController`). Strip it
+          # for index lookup — the discoverer registers entries
+          # under their unprefixed name. Without this strip a
+          # `class ActivityPub::ApplicationController <
+          # ::ApplicationController` parent never resolved.
+          name = name.sub(/\A::/, "")
+
+          # Constant already absolute or no enclosing scope.
+          return name if enclosing.nil? || enclosing.empty?
+
+          # Try the deepest enclosing scope first, walking
+          # outward. `enclosing = ["A", "B"]` produces
+          # candidates `["A::B::name", "A::name", "name"]`.
+          enclosing.length.downto(0).each do |depth|
+            prefix = enclosing[0, depth]
+            candidate = prefix.empty? ? name : "#{prefix.join('::')}::#{name}"
+            return candidate if @entries.key?(candidate)
+          end
+          name
+        end
+      end
+    end
+  end
+end

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack.rb

@@ -0,0 +1,261 @@
+# frozen_string_literal: true
+
+require "rigor/plugin"
+
+require_relative "actionpack/analyzer"
+require_relative "actionpack/controller_discoverer"
+require_relative "actionpack/controller_index"
+
+module Rigor
+  module Plugin
+    # rigor-actionpack — validates Action Pack DSL calls in
+    # controller files.
+    #
+    # **Phase 4 of the Action Pack plugin family** (route-helper
+    # consumption). Reads the `:helper_table` fact published by
+    # `rigor-rails-routes` (ADR-9 cross-plugin API) and validates
+    # every implicit-self `*_path` / `*_url` call inside files
+    # under `controller_search_paths` (default `app/controllers`).
+    #
+    # Tier 2 of the [Rails plugins roadmap](../../../../docs/design/20260508-rails-plugins-roadmap.md).
+    # Phase 1 (strong-parameters → AR column validation), Phase 2
+    # (filter chains), and Phase 3 (render targets) ship as
+    # separate slices; each phase composes additively under the
+    # same plugin id.
+    #
+    # ## Configuration
+    #
+    #     plugins:
+    #       - gem: rigor-rails-routes      # producer (must come first
+    #                                       # in `Configuration#plugins`
+    #                                       # ordering, OR the loader's
+    #                                       # ADR-9 topo sort handles it)
+    #       - gem: rigor-actionpack
+    #         config:
+    #           controller_search_paths: ["app/controllers"]   # default; optional
+    #
+    # ## What it checks
+    #
+    # - **Helper existence** — every `*_path` / `*_url` call
+    #   inside a controller file is looked up in the helper
+    #   table. Missing entries emit `unknown-helper` with a
+    #   `DidYouMean` suggestion drawn from the table.
+    # - **Helper arity** — the call's positional-argument count
+    #   is matched against the helper's recorded arity (a
+    #   trailing `KeywordHashNode` like `users_path(format: :json)`
+    #   is excluded; same convention `rigor-rails-routes` uses).
+    #   Mismatches emit `wrong-helper-arity`.
+    # - **Trace** — recognised helpers also emit a
+    #   `helper-call` info diagnostic naming the action and
+    #   path, mirroring the trace shape of the upstream plugin.
+    #
+    # ## Limitations
+    #
+    # - Implicit-self calls only. `Rails.application.routes.url_helpers.users_path`
+    #   and other explicit-receiver shapes are passed through;
+    #   they're rare in controller code and the helper table
+    #   doesn't include any extra context to validate them.
+    # - Files outside `controller_search_paths` are skipped.
+    #   The plugin doesn't try to detect "is this a controller?"
+    #   by class hierarchy — Phase 1's strong-parameters work
+    #   needs that, so it lives there. Phase 4's job is the
+    #   single-purpose helper check.
+    # - When `rigor-rails-routes` is not installed (or its
+    #   helper table is empty), Phase 4 silently degrades to a
+    #   no-op. No load-error diagnostic is emitted; the user
+    #   gets the "no checks happened" failure mode rather than
+    #   a wall of "is this configured right?" warnings.
+    class Actionpack < Rigor::Plugin::Base
+      manifest(
+        id: "actionpack",
+        # Bumped 2026-05-27 — analyzer-side nested-module
+        # qualification slice. `diagnose_filters` and
+        # `diagnose_renders` now thread the enclosing
+        # namespace through the AST walk so a
+        # `module Admin; class DomainBlocksController; end`
+        # file resolves as `Admin::DomainBlocksController`
+        # — matching the qualification the
+        # `ControllerDiscoverer` already records. Fixes render
+        # paths (`admin/domain_blocks/new` not bare
+        # `domain_blocks/new`) and filter-chain validation
+        # silently skipping nested controllers.
+        version: "0.7.0",
+        description: "Validates Action Pack route-helper calls and filter chains inside controllers.",
+        config_schema: {
+          "controller_search_paths" => :array,
+          "view_search_paths" => :array
+        },
+        consumes: [
+          { plugin_id: "rails-routes", name: :helper_table, optional: true },
+          { plugin_id: "activerecord", name: :model_index, optional: true }
+        ]
+      )
+
+      DEFAULT_CONTROLLER_SEARCH_PATHS = ["app/controllers"].freeze
+      DEFAULT_VIEW_SEARCH_PATHS = ["app/views"].freeze
+
+      # Phase 2 cached producer — the controller index built
+      # from `controller_search_paths`. The IoBoundary records
+      # a `FileEntry` digest for every file the discoverer
+      # reads, so the cache invalidates when any controller
+      # file changes.
+      producer :controller_index do |_params|
+        ControllerDiscoverer.new(
+          io_boundary: io_boundary,
+          search_paths: @controller_search_paths
+        ).discover
+      end
+
+      def init(services)
+        @services = services
+        @controller_search_paths = Array(
+          config.fetch("controller_search_paths", DEFAULT_CONTROLLER_SEARCH_PATHS)
+        ).map(&:to_s)
+        @view_search_paths = Array(
+          config.fetch("view_search_paths", DEFAULT_VIEW_SEARCH_PATHS)
+        ).map(&:to_s)
+        @helper_table = nil
+        @helper_table_resolved = false
+        @controller_index = nil
+        @model_index_value = nil
+        @model_index_resolved = false
+      end
+
+      def diagnostics_for_file(path:, scope:, root:) # rubocop:disable Lint/UnusedMethodArgument
+        return [] unless controller_file?(path)
+
+        helper_diagnostics(path, root) +
+          filter_diagnostics(path, root) +
+          render_diagnostics(path, root) +
+          permit_diagnostics(path, root)
+      end
+
+      private
+
+      def helper_diagnostics(path, root)
+        table = helper_table
+        return [] if table.nil? || table.empty?
+
+        Analyzer.diagnose(path: path, root: root, helper_table: table)
+                .map { |diag| build_diagnostic(diag) }
+      end
+
+      # Phase 2 — runs the filter-chain validator over the
+      # controller's class body using the cached
+      # {ControllerIndex}. Skips silently when the index is
+      # absent or doesn't recognise the file's top-level class.
+      def filter_diagnostics(path, root)
+        index = controller_index_or_nil
+        return [] if index.nil? || index.empty?
+
+        Analyzer.diagnose_filters(path: path, root: root, controller_index: index)
+                .map { |diag| build_diagnostic(diag) }
+      end
+
+      # Phase 3 — runs the render-target validator against the
+      # configured `view_search_paths`. Always invoked
+      # regardless of whether the controller is in the index;
+      # render shapes are recognised purely from the call site
+      # + class name, no per-controller pre-discovery needed.
+      def render_diagnostics(path, root)
+        Analyzer.diagnose_renders(
+          path: path, root: root,
+          view_search_roots: @view_search_paths,
+          controller_index: controller_index_or_nil
+        ).map { |diag| build_diagnostic(diag) }
+      end
+
+      # Phase 1 — strong-parameter validation. Reads the
+      # `:model_index` fact from the cross-plugin fact store
+      # (published by rigor-activerecord) and validates every
+      # `params.require(:user).permit(:name, :email)` chain
+      # against the User model's column list.
+      def permit_diagnostics(path, root)
+        index = model_index
+        return [] if index.nil? || index.empty?
+
+        Analyzer.diagnose_permits(path: path, root: root, model_index: index)
+                .map { |diag| build_diagnostic(diag) }
+      end
+
+      def controller_index_or_nil
+        return @controller_index if @controller_index
+
+        # Read project source first so the IoBoundary's
+        # FileEntry digests get captured into the descriptor
+        # before `cache_for` snapshots it (mirrors
+        # rigor-rails-routes / rigor-pundit's pattern).
+        prime_io_boundary_for_index
+        @controller_index = cache_for(:controller_index, params: {}).call
+      rescue StandardError
+        nil
+      end
+
+      def prime_io_boundary_for_index
+        @controller_search_paths.each do |root|
+          absolute = File.expand_path(root)
+          next unless File.directory?(absolute)
+
+          Dir.glob(File.join(absolute, "**", "*.rb")).each do |path|
+            io_boundary.read_file(path)
+          rescue Plugin::AccessDeniedError, Errno::ENOENT
+            nil
+          end
+        end
+      end
+
+      # Lazily resolves the helper table from the cross-plugin
+      # fact store. The cache is per-run because the runner
+      # builds a fresh `FactStore` per invocation; memoizing on
+      # the plugin instance saves the per-file `read` while
+      # still picking up a freshly-published table on the next
+      # `bundle exec rigor check` run.
+      def helper_table
+        return @helper_table if @helper_table_resolved
+
+        @helper_table = @services.fact_store.read(
+          plugin_id: "rails-routes", name: :helper_table
+        )
+        @helper_table_resolved = true
+        @helper_table
+      end
+
+      # Phase 1 — lazily reads the cross-plugin :model_index
+      # fact from rigor-activerecord. The cache is per-run
+      # because the runner builds a fresh FactStore per
+      # invocation; memoizing on the plugin instance saves the
+      # per-file read while still picking up a freshly
+      # published index on the next `bundle exec rigor check`.
+      def model_index
+        return @model_index_value if @model_index_resolved
+
+        @model_index_value = @services.fact_store.read(
+          plugin_id: "activerecord", name: :model_index
+        )
+        @model_index_resolved = true
+        @model_index_value
+      end
+
+      def controller_file?(path)
+        @controller_search_paths.any? do |root|
+          # The runner may pass `path` as either an absolute
+          # path (when `paths:` was configured absolutely) or a
+          # relative one (when configured relatively). The
+          # `controller_search_paths` knob is always project-
+          # root-relative. Match the configured root as a
+          # /-bracketed substring so both shapes resolve.
+          path.include?("/#{root}/") || path.start_with?("#{root}/") || path == root
+        end
+      end
+
+      def build_diagnostic(diag)
+        Rigor::Analysis::Diagnostic.new(
+          path: diag.path, line: diag.line, column: diag.column,
+          message: diag.message, severity: diag.severity, rule: diag.rule
+        )
+      end
+    end
+
+    Rigor::Plugin.register(Actionpack)
+  end
+end

data/plugins/rigor-actionpack/lib/rigor-actionpack.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+require_relative "rigor/plugin/actionpack"