rubocop-dev_doc 0.10.4 → 0.12.0

data/lib/rubocop/cop/dev_doc/auth/current_user_branching_helpers.rb

@@ -0,0 +1,176 @@
+module RuboCop
+  module Cop
+    module DevDoc
+      module Auth
+        # Condition analysis for CurrentUserBranching, extracted so the cop
+        # class stays within size limits. Everything here answers one
+        # question: is this AST node auth-state/authorization branching?
+        #
+        # Three mechanisms cooperate (see the cop docstring for doctrine):
+        # - AUTH ROOTS: bare `current_user` / `user_signed_in?` calls, PLUS
+        #   any local/instance variable assigned from `current_user` in the
+        #   same file (taint tracking — `@user = current_user` must not be a
+        #   way to launder the branch). Taint is per-file: an ivar assigned in
+        #   a controller and read in a view is NOT tracked — the companion
+        #   role-predicate cop covers that gap receiver-agnostically.
+        # - ALLOWED METHODS: the first method called on an auth root is
+        #   classified. Data reads (`errors`, project-configured readers like
+        #   `otp_required_for_login`) pass; everything else — role predicates,
+        #   unknown methods — flags until someone classifies it in
+        #   `AllowedMethods` (a deliberate, reviewed decision).
+        # - GUARD EXEMPTION: bare-return nil guards in every spelling stay
+        #   allowed (the correct pre-auth pattern).
+        module CurrentUserBranchingHelpers
+          # Universal non-permission data reads, allowed WITHOUT configuration.
+          # Lives in code (not default.yml) so a project setting its own
+          # AllowedMethods cannot accidentally drop the baseline — RuboCop
+          # REPLACES array config wholesale, it does not merge. The yml key is
+          # therefore purely additive.
+          DEFAULT_ALLOWED_METHODS = %i[errors id email persisted? new_record?].freeze
+
+          # Nil-test spellings that keep the guard-return exemption; role/data
+          # chains never qualify.
+          NIL_TEST_METHODS = %i[present? blank? nil? !].freeze
+
+          # Identity comparisons are display logic, not access decisions.
+          IDENTITY_COMPARISON_METHODS = %i[== !=].freeze
+
+          def on_new_investigation
+            super
+            @tainted_names = collect_tainted_names(processed_source.ast)
+          end
+
+          private
+
+          # Names that are PURE aliases of current_user: every assignment to
+          # the name, file-wide, is an unconditional `= current_user`. An
+          # assignment under an `if` is semantic narrowing (`@user =
+          # current_user` only when a token matches — the variable is
+          # genuinely nilable, and branching on it is resource-presence
+          # logic), and an assignment from any other source makes it a
+          # general holder; either disqualifies the name. `case` dispatch
+          # (glib_load_resource's per-action assignment) does NOT disqualify —
+          # per-action aliasing is still pure aliasing.
+          def collect_tainted_names(ast)
+            names = Set.new
+            disqualified = Set.new
+            ast&.each_node(:lvasgn, :ivasgn) do |assign|
+              target = pure_alias_assignment?(assign) ? names : disqualified
+              target << assign.children[0]
+            end
+            names - disqualified
+          end
+
+          def pure_alias_assignment?(assign)
+            value = assign.children[1]
+            return false unless value&.send_type? && value.method_name == :current_user && value.receiver.nil?
+
+            assign.each_ancestor(:if).none?
+          end
+
+          def tainted_ref?(node)
+            node&.type?(:lvar, :ivar) && @tainted_names.include?(node.children.first)
+          end
+
+          def auth_condition?(condition)
+            return false unless condition
+            return tainted_ref?(condition) if condition.type?(:lvar, :ivar)
+            return auth_condition?(condition.children.last) if condition.begin_type?
+            return condition.children.any? { |operand| auth_condition?(operand) } if condition.type?(:and, :or)
+
+            condition.type?(:send, :csend) && auth_send_condition?(condition)
+          end
+
+          def auth_send_condition?(node)
+            return true if bare_auth_call?(node)
+            # Identity comparisons are exempt in BOTH directions
+            # (`x.user == current_user` and `current_user.id == x`), so test
+            # before the chain-root rule.
+            return false if IDENTITY_COMPARISON_METHODS.include?(node.method_name)
+            # `!current_user` / `!user_signed_in?` (or a negated chain)
+            return auth_send_condition?(node.receiver) if node.method_name == :! && node.receiver&.type?(:send, :csend)
+            return flagged_chain_off_auth_root?(node)  if chain_first_hop(node)
+
+            current_user_as_access_argument?(node)
+          end
+
+          # The first method called on an auth root is the classified one:
+          # `current_user.oauth_tokens.any?` classifies `oauth_tokens` (the
+          # rest operates on the returned data). Allowed data reads pass;
+          # role predicates and unknown methods flag.
+          def flagged_chain_off_auth_root?(node)
+            !allowed_method?(chain_first_hop(node).method_name)
+          end
+
+          # The send whose receiver IS an auth root (bare current_user or a
+          # tainted alias) — nil when the chain isn't rooted at auth state.
+          # `user_signed_in?` accepts no chain (it returns a bool).
+          def chain_first_hop(node)
+            current = node
+            while current.respond_to?(:receiver) && current.receiver
+              return current if auth_root?(current.receiver)
+
+              current = current.receiver
+            end
+            nil
+          end
+
+          def auth_root?(node)
+            (node.send_type? && node.method_name == :current_user && node.receiver.nil?) || tainted_ref?(node)
+          end
+
+          def bare_auth_call?(node)
+            node.send_type? && self.class::AUTH_METHODS.include?(node.method_name) && node.receiver.nil?
+          end
+
+          def allowed_method?(method_name)
+            DEFAULT_ALLOWED_METHODS.include?(method_name) ||
+              (cop_config['AllowedMethods'] || []).map(&:to_sym).include?(method_name)
+          end
+
+          # `admins.include?(current_user)` / `accessible_by?(current_user)`
+          # in a condition — an access decision parameterised by the current
+          # user (or a tainted alias); belongs in the policy.
+          def current_user_as_access_argument?(node)
+            return false if IDENTITY_COMPARISON_METHODS.include?(node.method_name)
+
+            node.arguments.any? do |arg|
+              (arg.send_type? && arg.method_name == :current_user && arg.receiver.nil?) || tainted_ref?(arg)
+            end
+          end
+
+          # `return unless current_user` (and every nil-test SPELLING of it,
+          # on current_user or a tainted alias) is the correct guard pattern —
+          # the cop polices branching, not guard orthography. Role/data chains
+          # (`return unless current_user.admin?`) do NOT qualify.
+          def bare_return_guard?(node)
+            return false unless pure_auth_state_test?(node.condition)
+
+            bare_return_branch?(node.else_branch) || bare_return_branch?(node.if_branch)
+          end
+
+          def pure_auth_state_test?(condition)
+            return false if condition.nil?
+            return true if tainted_ref?(condition)
+            return false unless condition.type?(:send, :csend)
+            return true if bare_current_user?(condition)
+
+            nil_test_of_auth_state?(condition)
+          end
+
+          def nil_test_of_auth_state?(node)
+            NIL_TEST_METHODS.include?(node.method_name) && node.receiver && pure_auth_state_test?(node.receiver)
+          end
+
+          def bare_current_user?(node)
+            node.method_name == :current_user && node.receiver.nil?
+          end
+
+          def bare_return_branch?(branch)
+            branch&.return_type? && branch.children.empty?
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/dev_doc/auth/load_resource_current_user_guard.rb

@@ -274,11 +274,11 @@ module RuboCop
           # `raise`/`fail`. A multi-statement branch (a `begin`) counts when its
           # LAST statement does.
           def branch_exits?(branch)
+            branch = branch.children.last if branch&.begin_type?
             return false unless branch
 
-            branch = branch.children.last if branch.begin_type?
-            branch&.return_type? ||
-              (branch&.send_type? && branch.receiver.nil? && %i[raise fail].include?(branch.method_name))
+            branch.return_type? ||
+              (branch.send_type? && branch.receiver.nil? && %i[raise fail].include?(branch.method_name))
           end
         end
       end

data/lib/rubocop/cop/dev_doc/auth/role_predicate_outside_policy.rb

@@ -0,0 +1,102 @@
+module RuboCop
+  module Cop
+    module DevDoc
+      module Auth
+        # Role predicates must not be called outside the policy layer.
+        #
+        # ## Rationale
+        # A role predicate (`admin?`, `super_admin?`,
+        # `effective_admin_of_organization?`, ...) answers "what may this
+        # person do?" — an authorization question. Scattering those calls
+        # through controllers and views fragments the permission model: the
+        # Pundit policy says one thing, page code quietly decides another.
+        #
+        # This cop is the receiver-agnostic companion to
+        # `DevDoc/Auth/CurrentUserBranching`: that cop tracks `current_user`
+        # and its same-file aliases, but taint cannot follow an ivar from a
+        # controller into a view, and any wrapper method breaks the chain.
+        # Keying on the PREDICATE NAME instead means `current_user.admin?`,
+        # `@user.admin?`, `user.admin?`, and `viewer.admin?` are all equally
+        # visible — no alias or wrapper hides the question being asked.
+        #
+        # ## Remedy
+        # Move the decision into the Pundit policy and query it where needed:
+        # `policy(record).manage?` — no role predicate at the call site.
+        # Name the policy query after the DECISION it guards (`auto_approve?`,
+        # `initiation_blocked_for_admin?`), never after the role: a generic
+        # getter (`user_is_admin?`) re-exports the scattering through the
+        # policy door — every call site still maps role to behavior itself.
+        # Genuine display logic keyed on a role (badges, admin-only hints)
+        # belongs in a helper (an excluded path), where the branching is
+        # openly presentation-side.
+        #
+        # ## The ratchet
+        # Once page code queries policies by purpose, add any role-shaped
+        # getters your policies DO export (`user_is_super_admin?`, ...) to
+        # RolePredicates. Policies are excluded paths, so policy-internal use
+        # stays free while new loose call sites in page code flag mechanically.
+        #
+        # ## Configuration
+        # `RolePredicates` is a closed, per-project list — add every role
+        # predicate your User/Member models define:
+        #
+        #   DevDoc/Auth/RolePredicateOutsidePolicy:
+        #     RolePredicates:
+        #       - admin?
+        #       - super_admin?
+        #       - effective_admin_of_organization?
+        #       - explicit_admin_of_organization?
+        #
+        # ## Allowed paths (Exclude:)
+        # By default the cop is silent in:
+        #   app/policies/**/*.rb   ← where the predicates belong
+        #   app/models/**/*.rb     ← where they are defined/composed
+        #   app/helpers/**/*.rb    ← sanctioned display branching
+        #   app/views/layouts/**/* ← sanctioned display branching
+        #   test/, spec/           ← tests assert role facts as fixture
+        #                            preconditions; they verify the permission
+        #                            model rather than fragment it
+        #
+        # @example
+        #   # bad — controller decides a permission by role
+        #   if current_user.admin?
+        #     auto_approve
+        #   end
+        #
+        #   # bad — the alias dodge is equally visible
+        #   if @user.admin?
+        #     auto_approve
+        #   end
+        #
+        #   # good — the policy owns the decision; page code queries it
+        #   if policy(@organization).auto_approve?
+        #     auto_approve
+        #   end
+        class RolePredicateOutsidePolicy < Base
+          MSG = '`%<method>s` is a role predicate — an authorization question that belongs in ' \
+                'the Pundit policy. Move the DECISION there and query it by purpose ' \
+                '(`policy(record).auto_approve?`) — name the query after the decision it ' \
+                'guards, never after the role (`user_is_admin?` just re-exports the ' \
+                'scattering through the policy door, and belongs in this cop\'s ' \
+                'RolePredicates list). For pure display branching (badges, admin hints), ' \
+                'use a helper. Renaming the receiver never exempts it: the flagged thing ' \
+                'is the question, not who is asked.'.freeze
+
+          def on_send(node)
+            method_name = node.method_name
+            return unless role_predicates.include?(method_name)
+
+            add_offense(node.loc.selector, message: format(MSG, method: method_name))
+          end
+          alias on_csend on_send
+
+          private
+
+          def role_predicates
+            @role_predicates ||= (cop_config['RolePredicates'] || []).map(&:to_sym)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/dev_doc/i18n/localizable_props.rb

@@ -40,9 +40,7 @@ module RuboCop
           TRANSLATION_METHODS = %i[t translate].freeze
 
           def on_send(node)
-            if watched_methods.include?(node.method_name.to_s)
-              node.arguments.each { |arg| each_localizable(arg) }
-            end
+            node.arguments.each { |arg| each_localizable(arg) } if watched_methods.include?(node.method_name.to_s)
 
             check_jbuilder_positional(node)
           end
@@ -56,19 +54,22 @@ module RuboCop
           def each_localizable(node)
             case node.type
             when :hash
-              node.pairs.each do |pair|
-                key = pair.key
-                if key.sym_type? && localizable_keys.include?(key.value.to_s)
-                  inspect_localizable(key.value, pair.value)
-                end
-
-                each_localizable(pair.value)
-              end
+              node.pairs.each { |pair| walk_pair(pair) }
             when :array
               node.children.each { |child| each_localizable(child) }
+            else
+              # Any other node type (literal, send, variable…) can't contain
+              # localizable key-value pairs.
             end
           end
 
+          def walk_pair(pair)
+            key = pair.key
+            inspect_localizable(key.value, pair.value) if key.sym_type? && localizable_keys.include?(key.value.to_s)
+
+            each_localizable(pair.value)
+          end
+
           # jbuilder positional form: `json.title 'Forms'`. The method name is
           # the key and the first argument is the value. Restricted to the
           # jbuilder root `json` so ordinary `obj.text('...')` calls aren't

data/lib/rubocop/cop/dev_doc/i18n/translation_key_prefix.rb

@@ -74,6 +74,9 @@ module RuboCop
             when :dstr
               first = node.children.first
               first&.str_type? ? first.value : nil
+            else
+              # Fully dynamic key (variable, send…) — nil is this method's
+              # documented "statically unknown" return.
             end
           end
 

data/lib/rubocop/cop/dev_doc/migration/date_column_naming.rb

@@ -62,6 +62,9 @@ module RuboCop
               return if name.end_with?('_at')
 
               add_offense(col_name_node, message: format(DATETIME_MSG, name: name))
+            else
+              # add_column funnels every column type here; only date/time
+              # types carry a suffix naming rule.
             end
           end
         end

data/lib/rubocop/cop/dev_doc/rails/avoid_bypassing_validation.rb

@@ -125,8 +125,9 @@ module RuboCop
           private
 
           def receiver_shape_matches?(node)
-            return node.receiver&.const_type? if CONST_RECEIVER_ONLY.include?(node.method_name)
-            return !node.receiver&.const_type? if NON_CONST_RECEIVER_ONLY.include?(node.method_name)
+            const_receiver = node.receiver&.const_type?
+            return const_receiver if CONST_RECEIVER_ONLY.include?(node.method_name)
+            return !const_receiver if NON_CONST_RECEIVER_ONLY.include?(node.method_name)
 
             true
           end

data/lib/rubocop/cop/dev_doc/rails/avoid_lifecycle_method_override.rb

@@ -44,8 +44,8 @@ module RuboCop
         #    run — something `validate` can't express), disable this cop inline
         #    with a written justification:
         #
-        #      def run_validations! # rubocop:disable DevDoc/Rails/AvoidLifecycleMethodOverride
-        #        # Reason: <explanation>
+        #      # rubocop:disable DevDoc/Rails/AvoidLifecycleMethodOverride -- <explanation>
+        #      def run_validations!
         #        with_access { super }
         #      end
         #

data/lib/rubocop/cop/dev_doc/rails/avoid_rails_callbacks.rb

@@ -86,8 +86,8 @@ module RuboCop
         # genuine exception, disable this cop inline with a written
         # justification — expect pushback in review:
         #
-        #   after_create :some_callback # rubocop:disable DevDoc/Rails/AvoidRailsCallbacks
-        #   # Reason: <explanation>
+        #   # rubocop:disable DevDoc/Rails/AvoidRailsCallbacks -- <explanation>
+        #   after_create :some_callback
         #
         # Both the symbol form and the block form are flagged:
         #
@@ -136,7 +136,7 @@ module RuboCop
             add_offense(node.loc.selector, message: format(MSG, method: node.method_name))
           end
 
-          def on_block(node) # rubocop:disable InternalAffairs/NumblockHandler
+          def on_block(node)
             send_node = node.send_node
             return unless CALLBACKS.include?(send_node.method_name)
 

data/lib/rubocop/cop/dev_doc/rails/enum_column_not_null.rb

@@ -86,7 +86,9 @@ module RuboCop
 
           def enum_column(klass, name)
             table = schema.table_by(name: table_name(klass))
-            table&.columns&.find { |c| c.name == name.to_s }
+            return nil unless table
+
+            table.columns.find { |c| c.name == name.to_s }
           end
 
           def class_node(node)

data/lib/rubocop/cop/dev_doc/route/no_custom_actions.rb

@@ -121,7 +121,10 @@ module RuboCop
             return explicit.method_name.to_s if explicit
 
             # Otherwise the nearest block that isn't a transparent wrapper decides.
-            decider = sends.find { |s| !TRANSPARENT_WRAPPERS.include?(s.method_name) }
+            decider_context(sends.find { |s| !TRANSPARENT_WRAPPERS.include?(s.method_name) })
+          end
+
+          def decider_context(decider)
             return unless decider
 
             return 'collection' if RESOURCEFUL.include?(decider.method_name)

data/lib/rubocop/cop/dev_doc/route/resource_name_number.rb

@@ -48,13 +48,14 @@ module RuboCop
               expected = expected_name(node.method_name, name)
               next if expected == name
 
-              add_offense(
-                arg,
-                message: format(MSG, method: node.method_name, number: number_word(node.method_name), expected: expected)
-              )
+              add_offense(arg, message: offense_message(node.method_name, expected))
             end
           end
 
+          def offense_message(method_name, expected)
+            format(MSG, method: method_name, number: number_word(method_name), expected: expected)
+          end
+
           private
 
           # The resource name as a string, for symbol or string arguments only

data/lib/rubocop/cop/dev_doc/route/resources_require_only.rb

@@ -43,14 +43,13 @@ module RuboCop
           RESTRICT_ON_SEND = %i[resources resource].freeze
 
           def on_send(node)
-            has_only = key_present?(node, :only)
-            has_except = key_present?(node, :except)
+            return if key_present?(node, :only)
 
-            return if has_only
+            has_except = key_present?(node, :except)
             return if has_except && !require_only?
 
             name = node.first_argument&.value || '?'
-            msg = has_except && require_only? ? MSG_REQUIRE_ONLY : MSG
+            msg = has_except ? MSG_REQUIRE_ONLY : MSG
             add_offense(node.loc.selector, message: format(msg, method: node.method_name, name: name))
           end
 

data/lib/rubocop/cop/dev_doc/style/avoid_symbolizing_boundary_input.rb

@@ -0,0 +1,116 @@
+module RuboCop
+  module Cop
+    module DevDoc
+      module Style
+        # Flag `.to_sym` (including `&.to_sym`, and through laundering hops
+        # like `.presence`/`.to_s`/`.downcase`) chained directly onto an
+        # attacker-controlled boundary source: `params[...]` (also `.dig`,
+        # `.fetch`, `.require`) or `request.headers[...]`.
+        #
+        # ## Rationale
+        # A bare `.to_sym` lets ANY client-supplied value cross into the symbol
+        # domain, where downstream `case`/`==` dispatch treats it as known
+        # vocabulary. The allow-list is the missing DECISION: which values do
+        # we recognise, and what happens to the rest? Skipping it also mints a
+        # symbol per novel value (the classic symbol-DoS vector; GC reclaims
+        # dynamic symbols since Ruby 2.2, so today this is churn rather than a
+        # hard leak — the vocabulary laundering is the real bug).
+        #
+        # Resolve the value through the glib-web helper, which only ever
+        # returns a symbol already in the allow-list:
+        #
+        #   ❌
+        #   @mode = params[:mode]&.to_sym || :active
+        #
+        #   ✔️ (glib-web >= 5.1.2)
+        #   @mode = glib_allowlist_symbol_param(params[:mode], MODES, default: :active)
+        #
+        # When recognised inputs must map to differently-spelled symbols
+        # (e.g. `'spring-promo'` → `:spring_promo`), use an explicit
+        # `case`-when at the boundary instead — same allow-list property.
+        #
+        # ## Sources detected
+        # - `params[…]`, `params.dig(…)`, `params.fetch(…)`, `params.require(…)`
+        # - `request.headers[…]`
+        #
+        # `ENV[…]` is deliberately NOT a source here (unlike the sibling
+        # `DevDoc/Style/StringSymbolComparison`): ENV is operator-controlled,
+        # not attacker-reachable, and `.to_sym` on boot-time config is
+        # legitimate where the controller helper doesn't even exist.
+        #
+        # ## Relationship with DevDoc/Style/StringSymbolComparison
+        # Complementary pair over the same boundary doctrine: that cop flags
+        # comparing an UNCONVERTED string source against a symbol (always
+        # false); this cop flags CONVERTING without validating. The sanctioned
+        # exit from both is the allow-list helper.
+        #
+        # ## Limitations
+        # Only the direct form is caught. Once the value flows through a
+        # helper method (`report_params[:x]`) or a local/instance variable,
+        # static analysis loses the boundary and review has to catch it.
+        # Laundering transforms (`.presence`, `.to_s`, `.strip`,
+        # `.downcase`, `.upcase`, `.squish`) do NOT reset the trail — they
+        # transform, they don't validate.
+        #
+        # @example
+        #   # bad
+        #   @mode = params[:mode]&.to_sym || :active
+        #   @theme = request.headers['X-Theme']&.to_sym
+        #   @segment = params[:segment].presence&.to_sym
+        #   @sort = params[:sort].to_s.downcase.to_sym
+        #
+        #   # good
+        #   @mode = glib_allowlist_symbol_param(params[:mode], MODES, default: :active)
+        class AvoidSymbolizingBoundaryInput < Base
+          MSG = 'Unvalidated `.to_sym` on `%<source>s` lets any client value into the symbol ' \
+                'domain (and mints a symbol per novel value). Allow-list it instead: ' \
+                '`glib_allowlist_symbol_param(value, ALLOWED, default:)`. Laundering through ' \
+                '`.to_s`/`.presence`/`.downcase` is not validation.'.freeze
+
+          RESTRICT_ON_SEND = %i[to_sym].freeze
+
+          # String-preserving transforms that commonly sit between the boundary
+          # read and the `.to_sym` — they launder the value, not validate it,
+          # so the chain is still an offense.
+          TRANSFORM_HOPS = %i[presence to_s strip downcase upcase squish].freeze
+
+          def_node_matcher :params_access?, <<~PATTERN
+            (send (send nil? :params) {:[] :dig :fetch :require} ...)
+          PATTERN
+
+          def_node_matcher :request_headers_access?, <<~PATTERN
+            (send (send _ :headers) :[] _)
+          PATTERN
+
+          def on_send(node)
+            source = boundary_source_in(node.receiver)
+            return unless source
+
+            add_offense(node, message: format(MSG, source: source.source))
+          end
+          alias on_csend on_send
+
+          private
+
+          # The boundary source at the bottom of the receiver chain, walking
+          # through any number of laundering transforms. Returns nil for
+          # anything else (locals, `action_name`, helper-method results) so
+          # those don't false-positive.
+          def boundary_source_in(node)
+            while node
+              return node if boundary_source?(node)
+              return nil unless node.send_type? || node.csend_type?
+              return nil unless TRANSFORM_HOPS.include?(node.method_name)
+
+              node = node.receiver
+            end
+          end
+
+          def boundary_source?(node)
+            params_access?(node) || request_headers_access?(node)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/dev_doc/style/case_else_decision.rb

@@ -15,7 +15,8 @@ module RuboCop
         #
         # 1. **Fall-through genuinely happens in normal operation** — add
         #    `else` with a comment stating WHY it is correct (requires
-        #    `Style/EmptyElse` to be disabled).
+        #    `Style/EmptyElse` with `AllowComments: true`, which keeps that
+        #    cop's guard against comment-less empty elses).
         # 2. **A non-match is a bug and continuing is unsafe** — `else raise`
         #    (fail fast; unexpected enum/mode values must not proceed).
         # 3. **A non-match is a bug but users can safely continue** — report

data/lib/rubocop/cop/dev_doc/style/minimize_variable_scope.rb

@@ -83,21 +83,28 @@ module RuboCop
 
             siblings = parent.children
             nxt = siblings[siblings.index(asgn) + 1]
-            nxt if nxt&.if_type? && !nxt.ternary? && !nxt.modifier_form? && nxt.if?
+            nxt if plain_if?(nxt)
+          end
+
+          # A statement-form `if` (not a ternary, modifier, or unless).
+          def plain_if?(node)
+            node&.if_type? && !node.ternary? && !node.modifier_form? && node.if?
           end
 
           # `if x` or `if x.present?` — a truthiness check on the assigned var.
           def truthiness_check?(condition, name)
             return false unless condition
+            return condition.children.first == name if condition.lvar_type?
 
-            if condition.lvar_type?
-              condition.children.first == name
-            elsif condition.send_type? && TRUTHY_PREDICATES.include?(condition.method_name)
-              recv = condition.receiver
-              recv&.lvar_type? && recv.children.first == name
-            else
-              false
-            end
+            truthy_predicate_on?(condition, name)
+          end
+
+          # `x.present?`-style: a truthy predicate whose receiver is the var.
+          def truthy_predicate_on?(condition, name)
+            return false unless condition.send_type? && TRUTHY_PREDICATES.include?(condition.method_name)
+
+            recv = condition.receiver
+            recv&.lvar_type? && recv.children.first == name
           end
 
           # Every read of `name` in the enclosing scope sits inside the if's
@@ -109,12 +116,15 @@ module RuboCop
             return false unless single_plain_assignment?(scope, name, asgn)
             return false if rebinds_name?(scope, name)
 
+            reads_confined_to?(if_node, reads(scope, name))
+          end
+
+          # Read at least once in the true branch, and every read sits inside
+          # the if's condition or that branch.
+          def reads_confined_to?(if_node, refs)
             true_branch = if_node.if_branch
             return false unless true_branch
-
-            refs = reads(scope, name)
-            in_branch = refs.select { |r| within?(r, true_branch) }
-            return false if in_branch.empty?
+            return false if refs.none? { |r| within?(r, true_branch) }
 
             refs.all? { |r| within?(r, if_node.condition) || within?(r, true_branch) }
           end