rigortype 0.1.10 → 0.1.12

data/plugins/rigor-activerecord/lib/rigor/plugin/activerecord/analyzer.rb

@@ -0,0 +1,283 @@
+# frozen_string_literal: true
+
+require "prism"
+
+module Rigor
+  module Plugin
+    class Activerecord < Rigor::Plugin::Base
+      # Per-file AST walker. For each `Model.find(...)` /
+      # `Model.find_by(...)` / `Model.where(...)` call where
+      # `Model` is a name in the {ModelIndex}, emits diagnostics:
+      #
+      # | Method | Recognised arg shape | Validation |
+      # | --- | --- | --- |
+      # | `Model.find(id)` | any positional | arity check (1+ args) |
+      # | `Model.find_by(col: v, ...)` | keyword args | each key must be a column |
+      # | `Model.where(col: v, ...)` | keyword args | each key must be a column |
+      # | `Model.where(string)` | String literal | parser-side; not validated |
+      #
+      # Successful matches surface as `:info` diagnostics naming
+      # the resolved table; unknown columns surface as `:error`.
+      # Calls whose receiver is not a model in the index, and
+      # calls with non-keyword arguments to `where` / `find_by`,
+      # stay silent.
+      class Analyzer
+        # Methods that take a column → value Hash and need each key
+        # validated against the receiver's column set. The bang
+        # variants (`find_by!` raises instead of returning nil;
+        # `find_or_create_by!` raises on a validation failure) and
+        # `create_or_find_by` / `create_or_find_by!` take the
+        # identical column-hash argument shape.
+        COLUMN_HASH_METHODS = %i[
+          where
+          find_by find_by!
+          find_or_create_by find_or_create_by!
+          find_or_initialize_by
+          create_or_find_by create_or_find_by!
+        ].freeze
+
+        DID_YOU_MEAN_DISTANCE = 3
+
+        attr_reader :diagnostics
+
+        def initialize(path:, model_index:)
+          @path = path
+          @model_index = model_index
+          @diagnostics = []
+        end
+
+        def analyze(root)
+          walk(root) { |node| visit_call(node) if node.is_a?(Prism::CallNode) }
+          self
+        end
+
+        private
+
+        def walk(node, &)
+          return if node.nil?
+
+          yield node
+          node.compact_child_nodes.each { |child| walk(child, &) }
+        end
+
+        def visit_call(node)
+          model_name = constant_receiver_name(node.receiver)
+          return if model_name.nil?
+
+          entry = @model_index.find(model_name) ||
+                  @model_index.find("::#{model_name}")
+          return if entry.nil?
+
+          case node.name
+          when :find then validate_find(node, entry)
+          when *COLUMN_HASH_METHODS then validate_column_hash_call(node, entry)
+          end
+        end
+
+        def validate_find(node, entry)
+          arity = call_argument_count(node)
+          if arity.zero?
+            push_error(node, "wrong-arity",
+                       "`#{entry.class_name}.find` expects at least 1 argument, got 0")
+            return
+          end
+
+          push_info(node, "model-call",
+                    "`#{entry.class_name}.find` returns #{entry.class_name} (table: `#{entry.table_name}`)")
+        end
+
+        def validate_column_hash_call(node, entry)
+          keyword_pairs = keyword_argument_pairs(node)
+          return push_recognised(node, entry) if keyword_pairs.empty?
+
+          # Models with no schema-side columns are virtual — backed
+          # by a database VIEW (Mastodon's `Instance` model wraps a
+          # SQL view that isn't in `db/schema.rb`), seeded from an
+          # external source, or otherwise opaque to our schema
+          # parser. Without a column set we cannot meaningfully
+          # check query keys; surface the call as recognised and
+          # skip column validation entirely rather than firing a
+          # false `unknown-column` against every key.
+          return push_recognised(node, entry, keyword_pairs.map { |p| p[:key] }) if entry.column_names.empty?
+
+          unknown = keyword_pairs.reject { |pair| valid_query_key?(entry, pair[:key]) }
+          if unknown.empty?
+            keyword_pairs.each { |pair| validate_enum_value(node, entry, pair) }
+            push_recognised(node, entry, keyword_pairs.map { |p| p[:key] })
+          else
+            unknown.each do |pair|
+              key = pair[:key]
+              suggestion = closest_column(key, entry.column_names)
+              hint = suggestion ? " (did you mean `:#{suggestion}`?)" : ""
+              push_error(node, "unknown-column",
+                         "`#{entry.class_name}.#{node.name}(#{key}: ...)` references " \
+                         "unknown column `#{key}` on table `#{entry.table_name}`#{hint}")
+            end
+          end
+        end
+
+        # ActiveRecord's `where` / `find_by` / `find_or_initialize_by`
+        # accept either a column name *or* a singular association
+        # name (belongs_to / has_one). The latter resolves to the
+        # association's FK column behind the scenes:
+        #
+        #   AccountPin.find_by(account: x)
+        #   # → SELECT … WHERE account_id = x.id
+        #
+        # Without this allowance, every `find_by(<assoc>:)` call
+        # surfaces as an `unknown-column` false positive — Mastodon
+        # saw ~100 such hits across the API controllers, all of
+        # which were the canonical Rails idiom rather than typos.
+        #
+        # `alias_attribute` names resolve to their target before
+        # the column / association check — querying by an aliased
+        # attribute is a valid Rails idiom and must not surface as
+        # an `unknown-column`.
+        def valid_query_key?(entry, key)
+          key = entry.resolve_alias(key) if entry.alias?(key)
+
+          return true if entry.column?(key)
+
+          assoc = entry.association(key)
+          assoc && assoc[:kind] == :singular
+        end
+
+        # When the column is an enum-bearing column AND the
+        # passed value is a Symbol literal, the value MUST be
+        # one of the declared enum values. Non-Symbol values
+        # (variables, expressions) decline so dynamic call
+        # sites stay silent. Sequences (`status: [:active,
+        # :archived]`) are intentionally NOT walked here —
+        # the relation-shape check belongs in a future track.
+        def validate_enum_value(node, entry, pair)
+          return unless entry.enum?(pair[:key])
+          return unless pair[:value].is_a?(Prism::SymbolNode)
+
+          value = pair[:value].unescaped
+          values = entry.enum_values(pair[:key])
+          return if values.include?(value)
+
+          suggestion = closest_column(value, values)
+          hint = suggestion ? " (did you mean `:#{suggestion}`?)" : ""
+          push_error(node, "unknown-enum-value",
+                     "`#{entry.class_name}.#{node.name}(#{pair[:key]}: :#{value})` references " \
+                     "unknown enum value `:#{value}` (declared: #{values.map { |v| ":#{v}" }.join(', ')})#{hint}")
+        end
+
+        def push_recognised(node, entry, keys = nil)
+          msg = "`#{entry.class_name}.#{node.name}`"
+          msg += " (#{keys.map { |k| ":#{k}" }.join(', ')})" if keys && !keys.empty?
+          msg += " on table `#{entry.table_name}`"
+          push_info(node, "model-call", msg)
+        end
+
+        def constant_receiver_name(node)
+          case node
+          when Prism::ConstantReadNode
+            node.name.to_s
+          when Prism::ConstantPathNode
+            constant_path_name(node)
+          end
+        end
+
+        def constant_path_name(node)
+          parts = []
+          current = node
+          while current.is_a?(Prism::ConstantPathNode)
+            parts.unshift(current.name.to_s)
+            current = current.parent
+          end
+          case current
+          when nil
+            "::#{parts.join('::')}"
+          when Prism::ConstantReadNode
+            "#{current.name}::#{parts.join('::')}"
+          end
+        end
+
+        def call_argument_count(node)
+          return 0 if node.arguments.nil?
+
+          node.arguments.arguments.size
+        end
+
+        # Returns the symbol-keyed pairs of any KeywordHashNode
+        # argument as `{ key:, value: }` rows. Plain hash-literal
+        # arguments (`Model.where({a: 1})`) are NOT walked —
+        # Rails accepts both, but the keyword form is the
+        # idiomatic one. The `value` Prism node is preserved so
+        # the enum check downstream can recognise Symbol
+        # literals without re-walking the call.
+        def keyword_argument_pairs(node)
+          return [] if node.arguments.nil?
+
+          pairs = []
+          node.arguments.arguments.each do |arg|
+            next unless arg.is_a?(Prism::KeywordHashNode)
+
+            arg.elements.each do |pair|
+              next unless pair.is_a?(Prism::AssocNode) && pair.key.is_a?(Prism::SymbolNode)
+
+              pairs << { key: pair.key.unescaped, value: pair.value }
+            end
+          end
+          pairs
+        end
+
+        def closest_column(name, candidates)
+          best = nil
+          best_distance = DID_YOU_MEAN_DISTANCE + 1
+          candidates.each do |candidate|
+            distance = levenshtein(name, candidate)
+            if distance < best_distance
+              best = candidate
+              best_distance = distance
+            end
+          end
+          best
+        end
+
+        def levenshtein(a, b) # rubocop:disable Naming/MethodParameterName
+          return b.length if a.empty?
+          return a.length if b.empty?
+
+          rows = Array.new(a.length + 1) { |_i| Array.new(b.length + 1, 0) }
+          (0..a.length).each { |i| rows[i][0] = i }
+          (0..b.length).each { |j| rows[0][j] = j }
+
+          (1..a.length).each do |i|
+            (1..b.length).each do |j|
+              cost = a[i - 1] == b[j - 1] ? 0 : 1
+              rows[i][j] = [
+                rows[i - 1][j] + 1,
+                rows[i][j - 1] + 1,
+                rows[i - 1][j - 1] + cost
+              ].min
+            end
+          end
+          rows[a.length][b.length]
+        end
+
+        def push_info(node, rule, message)
+          push_diagnostic(node, severity: :info, rule: rule, message: message)
+        end
+
+        def push_error(node, rule, message)
+          push_diagnostic(node, severity: :error, rule: rule, message: message)
+        end
+
+        def push_diagnostic(node, severity:, rule:, message:)
+          location = node.location
+          @diagnostics << Rigor::Analysis::Diagnostic.new(
+            path: @path,
+            line: location.start_line,
+            column: location.start_column + 1,
+            message: message,
+            severity: severity,
+            rule: rule
+          )
+        end
+      end
+    end
+  end
+end

data/plugins/rigor-activerecord/lib/rigor/plugin/activerecord/inflector.rb

@@ -0,0 +1,114 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Plugin
+    class Activerecord < Rigor::Plugin::Base
+      # Tiny inflection helper for the common `ClassName → snake_case_plural`
+      # mapping Rails uses to derive table names. Deliberately
+      # narrow — handles the regular cases (`User → users`,
+      # `BlogPost → blog_posts`, `Category → categories`,
+      # `Bus → buses`, `Wolf → wolves`). Irregular plurals
+      # (`Person → people`, `Mouse → mice`, `Datum → data`) are
+      # NOT handled; the user is expected to declare
+      # `self.table_name = "people"` for those.
+      #
+      # Avoids an `activesupport` runtime dependency. Rails apps
+      # that need richer inflection should set explicit table
+      # names on the affected models.
+      module Inflector
+        IRREGULAR_PLURALS = {
+          # Common ones we still want to handle without bringing
+          # in a full inflection table. Users get the configured
+          # explicit table_name route for anything else.
+          "person" => "people",
+          "child" => "children",
+          "datum" => "data"
+        }.freeze
+
+        module_function
+
+        # `BlogPost` → `blog_posts`. `User::Profile` → `user_profiles`
+        # (Rails-style namespacing flattens with underscore).
+        def tableize(class_name)
+          underscore = underscore(class_name.to_s.gsub("::", "/"))
+          # `user/profiles` → `user_profiles`
+          underscore = underscore.tr("/", "_")
+          pluralize(underscore)
+        end
+
+        # `BlogPost` → `blog_post`. Standard Rails-style underscore.
+        def underscore(camel_case_word)
+          word = camel_case_word.to_s.dup
+          word.gsub!(/([A-Z]+)([A-Z][a-z])/, '\1_\2')
+          word.gsub!(/([a-z\d])([A-Z])/, '\1_\2')
+          word.tr!("-", "_")
+          word.downcase!
+          word
+        end
+
+        # `users` → `User`, `blog_posts` → `BlogPost`.
+        # Used by the association detector to map an
+        # association NAME (`has_many :posts` → `Post`) to the
+        # target class without requiring an explicit
+        # `class_name:` option. Singularises the word first,
+        # then camel-cases. Recognises the same irregular
+        # plurals as {.pluralize}.
+        def classify(word)
+          camelize(singularize(word.to_s))
+        end
+
+        # `posts` → `post`, `categories` → `category`,
+        # `wolves` → `wolf`, `buses` → `bus`. The inverse of
+        # {.pluralize} for the regular cases this module
+        # recognises. Irregular forms (`people` → `person`)
+        # round-trip via {IRREGULAR_PLURALS}.
+        def singularize(word)
+          IRREGULAR_PLURALS.each { |singular, plural| return singular if word == plural }
+
+          case word
+          when /(.*[bcdfghjklmnpqrstvwxz])ies\z/
+            "#{Regexp.last_match(1)}y"
+          when /(.*[sxz]|.*[cs]h)es\z/
+            Regexp.last_match(0)[0..-3]
+          when /(.*)ves\z/
+            "#{Regexp.last_match(1)}f"
+          when /(.+)s\z/
+            Regexp.last_match(1)
+          else
+            word
+          end
+        end
+
+        # `blog_post` → `BlogPost`. Camelizes around `_` and
+        # `/` separators; the latter promotes namespace boundaries
+        # to `::` (Rails-style).
+        def camelize(snake)
+          snake.to_s.split("/").map do |segment|
+            segment.split("_").map { |part| part.empty? ? part : part[0].upcase + part[1..] }.join
+          end.join("::")
+        end
+
+        # `user` → `users`, `category` → `categories`,
+        # `bus` → `buses`, `wolf` → `wolves`. Falls back to a
+        # plain `+ "s"` for unrecognised endings.
+        def pluralize(word)
+          return IRREGULAR_PLURALS[word] if IRREGULAR_PLURALS.key?(word)
+
+          case word
+          when /(.*[bcdfghjklmnpqrstvwxz])y\z/
+            # `category` → `categories`, `cherry` → `cherries`
+            "#{Regexp.last_match(1)}ies"
+          when /(.*[sxz]|.*[cs]h)\z/
+            # `bus` → `buses`, `box` → `boxes`, `dish` → `dishes`
+            "#{Regexp.last_match(0)}es"
+          when /(.*)fe?\z/
+            # `wolf` → `wolves`, `knife` → `knives`
+            "#{Regexp.last_match(1)}ves"
+          else
+            "#{word}s"
+          end
+        end
+      end
+    end
+  end
+end