rubocop-hanami 0.1.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9d0cdb245fcc1d369d11881b9ebc6064cc09dfe3acf0267fd2329fe3cd0f662c
-  data.tar.gz: 9649a91707ea8b596f96edb4e6c636a3ed6fe1b323a1533c1395c032178b4116
+  metadata.gz: b66d94028f3350e9dc3966897abca014e9ccad980d431858e664b43421293cd2
+  data.tar.gz: 461f52c846ff69d42d92f1ba5e9f88259b88e32607f0f61130e0d650e359e95d
 SHA512:
-  metadata.gz: b0c2d75c9f70db90f82d4bb707b315a178972c6a761f681264f3b6739cffe155c80e76c74e253dcd8bd5ccd6e35e878410eb1b3989c641e5c9125493506da7b1
-  data.tar.gz: 38031749617b42962b73ef90165d04ca176b5c2160265c3207a2a847f1314d70dc3886bda2e4feb865d9d9fed473635601e9b96279041c761345b029c5023770
+  metadata.gz: c675f410f6986ad1f8d8cce76f009ed5bdec6b33311d1ce4d49c2f0086d301f17cd4dd1f0d93e23406edad78d90ea5429f08bb50927fc2c358e94cda0a8c9e05
+  data.tar.gz: 83e3270654f1717d865a996e5257becb33edc829cb5ce1d8bd0722762586996465683d6d0793c0bb9246f30e0deb9ec21a79171150d1698346e3fd151eba4161

data/CHANGELOG.md

@@ -7,6 +7,67 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [v0.2.1] - 2026-10-18
+
+### Added
+
+- `AllowedNames` for `Hanami/UnusedDeps`, a list of accessor names the cop never flags in any class. Use it for names
+  read somewhere the cop can't follow. It also hides a real unused dependency of that name, so keep the list short.
+
+### Changed
+
+- `Hanami/UnusedDeps` counts a dependency as used when a parent class, a subclass at any depth, or a module either
+  one includes reads it. A base operation that reads `contract` while each subclass injects its own no longer flags
+  every subclass. The cop parses every file under `app`, `lib` and `slices` to follow them, and stops at constants
+  the project doesn't define, such as `Hanami::Action`.
+- While `Hanami/UnusedDeps` is on, any change to a file under `app`, `lib` or `slices` clears RuboCop's cached
+  results for every cop and every file, since one class's result now depends on others.
+- `Hanami/SliceNamespace` reads the acronyms in `config/app.rb`, so `inflections.acronym "TMAS"` turns
+  `tmas_gate_counts` into `TMASGateCounts` with no cop config. `Inflections` keys now match word by word as well as
+  by whole slice name.
+
+### Fixed
+
+- `Hanami/UnusedDeps` flagged a dependency that `initialize` took as a keyword and read in its body. A keyword only
+  passed on to `super` still counts as unused.
+
+## [v0.2.0] - 2026-10-07
+
+### Added
+
+- `Hanami/ActionCallOverride`, which flags `def call` in an action, where `handle` belongs. A class counts as an
+  action when its file sits under `actions` or it inherits from one of `ParentClasses`, `Hanami::Action` by
+  default. A `call` that calls `super` passes.
+- `Hanami/AppReferenceInSlice`, which flags `Hanami.app` in a slice, outside slice `config`. It leaves lookups such
+  as `Hanami.app["logger"]` to `Hanami/ContainerLookup` while that cop is on. `AppNamespaces` names the host app's
+  top-level modules, such as `MyApp`, to flag those too.
+- `Hanami/ContainerLookup`, which flags a lookup by literal key on `Hanami.app`, on `Hanami.app.slices[...]` or on
+  any constant that ends in `Slice`, where `include Deps[...]` would do. This also catches code that reaches into
+  another slice's container without `import`. `AllowedReceivers` names constants to skip.
+- `Hanami/EnvAccess`, which flags `ENV` outside settings, providers, `config/app.rb`, `config/puma.rb`, `bin`, `db`
+  and `spec`, so values go through Hanami settings and fail at boot when missing.
+- `Hanami/PersistenceInAction`, off by default, which flags a repo or relation in an action's `include Deps[...]`.
+  `ForbiddenKeyPrefixes` match at the start of any segment, so an imported `search.repos.index` counts.
+  `AllowedKeys` takes strings and regular expressions to let keys through.
+- `Hanami/ProviderTopLevelRequire`, which flags `require` and `require_relative` in a provider outside `prepare`
+  and `start`.
+- `Hanami/RelationOutsideRepo`, which flags a relation, or the ROM container, in `include Deps[...]` outside
+  `repos`, `relations` and `db`. `RelationKeyPrefixes` and `ROMKeys` name the keys to flag.
+- `Hanami/SliceNamespace`, which flags a top-level `module` or `class` in `slices/<name>/` that doesn't open the
+  slice's namespace, so a Zeitwerk load error shows up at lint time. `Inflections` names slices that don't
+  camelize plainly, such as `api: API`.
+- `Hanami/UnusedDeps`, which flags a key in `include Deps[...]` whose accessor the class never reads. It can't see
+  reads in a subclass in another file, so disable it on keys meant for subclasses.
+- `Hanami/UnvalidatedParams`, which flags `[]`, `fetch` and `dig` on `request.params` in an action that declares no
+  `params` or `contract`. `AllowedParentClasses` skips subclasses of a validated base action.
+- `Hanami/UnwrappedStep`, which flags a call in an operation's flow to a method that returns `Success` or `Failure`
+  but isn't passed to `step`, since dry-operation drops the `Failure`. `FlowMethods` names the flow methods, `call`
+  by default, and the cop reads `operate_on` too.
+
+### Fixed
+
+- `Hanami/SliceExports` no longer warns that it does not support `AllowedExports` when a config sets it.
+
 ## [v0.1.0] - 2026-10-07
 
 ### Added
@@ -16,5 +77,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `ParentClasses` names the superclasses that mark a class as a slice, `Hanami::Slice` by default.
   `RequireExport: false` lets a slice leave out `export`.
 
-[Unreleased]: https://github.com/aaronmallen/rubocop-hanami/compare/0.1.0...HEAD
+[Unreleased]: https://github.com/aaronmallen/rubocop-hanami/compare/0.2.1...HEAD
+[v0.2.1]: https://github.com/aaronmallen/rubocop-hanami/releases/tag/0.2.1
+[v0.2.0]: https://github.com/aaronmallen/rubocop-hanami/releases/tag/0.2.0
 [v0.1.0]: https://github.com/aaronmallen/rubocop-hanami/releases/tag/0.1.0

data/config/default.yml

@@ -5,7 +5,142 @@ Hanami/SliceExports:
   Include:
     - "**/config/slices/*.rb"
     - "**/slices/*/config/slice.rb"
+  AllowedExports: []
   ForbiddenExports: []
   ParentClasses:
     - Hanami::Slice
   RequireExport: true
+
+Hanami/ContainerLookup:
+  Description: Checks for container lookups where `include Deps[...]` would do.
+  Enabled: true
+  VersionAdded: "0.2.0"
+  Include:
+    - "app/**/*.rb"
+    - "slices/**/*.rb"
+    - "lib/**/*.rb"
+  Exclude:
+    - "config/**/*"
+    - "slices/*/config/**/*"
+    - "spec/**/*"
+  AllowedReceivers: []
+
+Hanami/AppReferenceInSlice:
+  Description: Checks for references to `Hanami.app` from a slice.
+  Enabled: true
+  VersionAdded: "0.2.0"
+  Include:
+    - "slices/**/*.rb"
+  Exclude:
+    - "slices/*/config/**/*"
+  AppNamespaces: []
+
+Hanami/RelationOutsideRepo:
+  Description: Checks for relations in `include Deps[...]` outside a repo.
+  Enabled: true
+  VersionAdded: "0.2.0"
+  Include:
+    - "app/**/*.rb"
+    - "slices/**/*.rb"
+  Exclude:
+    - "app/db/**/*"
+    - "app/relations/**/*"
+    - "app/repos/**/*"
+    - "slices/*/config/**/*"
+    - "slices/*/db/**/*"
+    - "slices/*/relations/**/*"
+    - "slices/*/repos/**/*"
+  RelationKeyPrefixes:
+    - relations.
+  ROMKeys:
+    - db.rom
+    - persistence.rom
+
+Hanami/PersistenceInAction:
+  Description: Checks for repos and relations in an action's `include Deps[...]`.
+  Enabled: false
+  VersionAdded: "0.2.0"
+  Include:
+    - "**/actions/**/*.rb"
+  AllowedKeys: []
+  ForbiddenKeyPrefixes:
+    - repos.
+    - relations.
+
+Hanami/UnusedDeps:
+  Description: Checks for keys in `include Deps[...]` that the class never reads.
+  Enabled: true
+  VersionAdded: "0.2.0"
+  Include:
+    - "app/**/*.rb"
+    - "slices/**/*.rb"
+    - "lib/**/*.rb"
+  AllowedNames: []
+
+Hanami/EnvAccess:
+  Description: Checks for `ENV` outside settings and providers.
+  Enabled: true
+  VersionAdded: "0.2.0"
+  Include:
+    - "**/*.rb"
+  Exclude:
+    - "bin/**/*"
+    - "config.ru"
+    - "config/app.rb"
+    - "config/providers/**/*"
+    - "config/puma.rb"
+    - "config/settings.rb"
+    - "db/**/*"
+    - "Rakefile"
+    - "slices/*/config/providers/**/*"
+    - "slices/*/config/settings.rb"
+    - "spec/**/*"
+
+Hanami/ActionCallOverride:
+  Description: Checks for `def call` in an action, where `handle` belongs.
+  Enabled: true
+  VersionAdded: "0.2.0"
+  Include:
+    - "app/**/*.rb"
+    - "slices/**/*.rb"
+  ParentClasses:
+    - Hanami::Action
+
+Hanami/UnvalidatedParams:
+  Description: Checks for `request.params` reads in an action with no `params` or `contract`.
+  Enabled: true
+  VersionAdded: "0.2.0"
+  Include:
+    - "**/actions/**/*.rb"
+  AllowedParentClasses: []
+
+Hanami/ProviderTopLevelRequire:
+  Description: Checks for `require` in a provider outside `prepare` and `start`.
+  Enabled: true
+  VersionAdded: "0.2.0"
+  Include:
+    - "**/config/providers/*.rb"
+    - "**/slices/*/config/providers/*.rb"
+
+Hanami/UnwrappedStep:
+  Description: Checks for calls in an operation's flow that return a Result but skip `step`.
+  Enabled: true
+  VersionAdded: "0.2.0"
+  Include:
+    - "app/**/*.rb"
+    - "slices/**/*.rb"
+    - "lib/**/*.rb"
+  FlowMethods:
+    - call
+
+Hanami/SliceNamespace:
+  Description: Checks that files in a slice open the slice's namespace.
+  Enabled: true
+  VersionAdded: "0.2.0"
+  Include:
+    - "slices/**/*.rb"
+  Exclude:
+    - "slices/*/config/routes.rb"
+    - "slices/*/config/settings.rb"
+    - "slices/*/db/**/*"
+  Inflections: {}

data/lib/rubocop/cop/hanami/action_call_override.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Hanami
+      # Checks for `def call` in an action. `Hanami::Action#call(env)` is the Rack entry point. It
+      # builds the request and response, runs callbacks and params validation, then calls
+      # `handle`. Defining `call` replaces all of that.
+      #
+      # A class counts as an action when it inherits from one of `ParentClasses` or lives in a file
+      # under `actions`. The cop skips a `call` that calls `super`, as a base action may wrap `call`
+      # on purpose.
+      #
+      # @example
+      #   # bad
+      #   class Actions::Home::Show < App::Action
+      #     def call(env)
+      #       [200, {}, ["hi"]]
+      #     end
+      #   end
+      #
+      #   # good
+      #   class Actions::Home::Show < App::Action
+      #     def handle(request, response)
+      #       response.body = "hi"
+      #     end
+      #   end
+      class ActionCallOverride < Base
+        MSG = "Define `handle` instead of `call` in an action."
+
+        def on_def(node)
+          return unless node.method?(:call) && action?(node.each_ancestor(:class, :module, :sclass).first)
+          return if node.each_descendant(:super, :zsuper).any?
+
+          add_offense(node.loc.keyword.join(node.loc.name))
+        end
+
+        private
+
+        def action?(scope)
+          return false unless scope&.class_type?
+          return true if %r{(\A|/)actions/}.match?(processed_source.file_path)
+
+          parent = scope.parent_class
+          parent&.const_type? && Array(cop_config["ParentClasses"]).include?(parent.const_name)
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/hanami/app_reference_in_slice.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Hanami
+      # Checks for `Hanami.app` in a slice. A slice should depend only on its own container and what
+      # it imports. `Hanami.app` ties it to the host app, so it can't be moved, extracted or loaded
+      # alone.
+      #
+      # When `Hanami/ContainerLookup` is on, this cop leaves a lookup such as `Hanami.app["logger"]`
+      # to it, so a line isn't flagged twice. `AppNamespaces` names top-level constants that belong
+      # to the host app, such as `MyApp`, to flag those as well. It is empty by default because the
+      # cop can't learn the app's name from one file.
+      #
+      # @example
+      #   # bad
+      #   class Admin::Actions::Users::Index < Admin::Action
+      #     def handle(request, response)
+      #       Hanami.app.settings.page_size
+      #     end
+      #   end
+      #
+      #   # good
+      #   class Admin::Actions::Users::Index < Admin::Action
+      #     include Deps["settings"]
+      #
+      #     def handle(request, response)
+      #       settings.page_size
+      #     end
+      #   end
+      #
+      # @example AppNamespaces: ['MyApp']
+      #   # bad
+      #   MyApp::Types::String
+      class AppReferenceInSlice < Base
+        MSG = "Don't reference `%<name>s` from a slice; use `Deps` or `import`."
+        RESTRICT_ON_SEND = %i[app].freeze
+
+        def_node_matcher :hanami_app?, "(send (const {nil? cbase} :Hanami) :app)"
+
+        def_node_matcher :container_lookup?, <<~PATTERN
+          (send {#hanami_app? (send (send #hanami_app? :slices) :[] _)} :[] str)
+        PATTERN
+
+        def on_const(node)
+          return unless node.namespace.nil? || node.namespace.cbase_type?
+          return unless Array(cop_config["AppNamespaces"]).include?(node.short_name.to_s)
+
+          add_offense(node, message: format(MSG, name: node.short_name))
+        end
+
+        def on_send(node)
+          return unless hanami_app?(node)
+          return if left_to_container_lookup?(node)
+
+          add_offense(node, message: format(MSG, name: "Hanami.app"))
+        end
+
+        private
+
+        def left_to_container_lookup?(node)
+          return false unless config.cop_enabled?("Hanami/ContainerLookup")
+
+          [node.parent, node.parent&.parent&.parent].any? { |lookup| lookup && container_lookup?(lookup) }
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/hanami/container_lookup.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Hanami
+      # Checks for a container lookup by key where `include Deps[...]` would do. Each lookup hides a
+      # dependency from the constructor, so a test can't pass a stub through `new` and the class
+      # header no longer says what the class needs.
+      #
+      # The cop flags `[]` with a literal string on `Hanami.app`, on `Hanami.app.slices[...]` and on
+      # any constant that ends in `Slice`. It skips a key that isn't a literal string, since the
+      # message can't name it. `AllowedReceivers` names constants to skip, for an app that wraps
+      # the container on purpose.
+      #
+      # @example
+      #   # bad
+      #   class Admin::Actions::Users::Show < Admin::Action
+      #     def handle(request, response)
+      #       user = Admin::Slice["repos.user_repo"].find(request.params[:id])
+      #     end
+      #   end
+      #
+      #   # good
+      #   class Admin::Actions::Users::Show < Admin::Action
+      #     include Deps["repos.user_repo"]
+      #
+      #     def handle(request, response)
+      #       user = user_repo.find(request.params[:id])
+      #     end
+      #   end
+      #
+      # @example AllowedReceivers: ['Admin::Slice']
+      #   # good
+      #   Admin::Slice["repos.user_repo"]
+      class ContainerLookup < Base
+        MSG = "Use `include Deps[\"%<key>s\"]` instead of a container lookup."
+        RESTRICT_ON_SEND = %i[[]].freeze
+
+        def_node_matcher :hanami_app?, "(send (const {nil? cbase} :Hanami) :app)"
+
+        def_node_matcher :container_lookup, <<~PATTERN
+          (send ${(const _ :Slice) #hanami_app? (send (send #hanami_app? :slices) :[] _)} :[] (str $_))
+        PATTERN
+
+        def on_send(node)
+          container_lookup(node) do |receiver, key|
+            return if receiver.const_type? && Array(cop_config["AllowedReceivers"]).include?(receiver.const_name)
+
+            add_offense(node, message: format(MSG, key: key))
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/hanami/env_access.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Hanami
+      # Checks for `ENV` outside settings and providers. Hanami settings give each value a name, a
+      # type and a check at boot. A raw `ENV` read skips all three, and a missing variable shows up
+      # at request time. Writes count too.
+      #
+      # @example
+      #   # bad
+      #   class Mailers::Welcome
+      #     def from = ENV.fetch("MAIL_FROM")
+      #   end
+      #
+      #   # good
+      #   class Mailers::Welcome
+      #     include Deps["settings"]
+      #
+      #     def from = settings.mail_from
+      #   end
+      class EnvAccess < Base
+        MSG = "Read settings, not `ENV`."
+        MSG_KEY = "Read `%<key>s` through settings, not `ENV`."
+
+        def_node_matcher :env?, "(const {nil? cbase} :ENV)"
+        def_node_matcher :env_key, "(send #env? _ (str $_) ...)"
+
+        def on_const(node)
+          return unless env?(node)
+
+          parent = node.parent
+          return add_offense(node, message: MSG) unless parent&.send_type? && parent.receiver.equal?(node)
+
+          key = env_key(parent)
+          add_offense(parent, message: key ? format(MSG_KEY, key: key) : MSG)
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/hanami/mixin/deps_keys.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Hanami
+      # Reads the keys of `include Deps[...]`.
+      module DepsKeys
+        extend NodePattern::Macros
+
+        # The accessor name dry-auto_inject gives a plain key, from Dry::AutoInject::DependencyMap.
+        NAME = /([a-z_][a-zA-Z_0-9]*)\z/
+
+        def_node_matcher :deps_arguments, "(send nil? :include (send (const {nil? cbase} :Deps) :[] $...))"
+
+        private
+
+        # Yields each literal key string in `arguments`, with the name of the accessor it defines. A
+        # trailing hash sets aliases: `mailer: "mailers.welcome"` defines `mailer`.
+        def each_deps_key(arguments)
+          arguments.each do |argument|
+            if argument.str_type?
+              yield argument, argument.value[NAME, 1]
+            elsif argument.hash_type?
+              argument.pairs.each { |pair| yield pair.value, pair.key.value.to_s if literal_alias?(pair) }
+            end
+          end
+        end
+
+        def literal_alias?(pair)
+          pair.key.type?(:sym, :str) && pair.value.str_type?
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/hanami/persistence_in_action.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Hanami
+      # Checks for an action that depends on a repo or relation through `include Deps[...]`. Some
+      # teams want actions to do only HTTP work and hand the rest to an operation, so persistence and
+      # business rules live in one place that tests can call without a request. This cop is off by
+      # default.
+      #
+      # `ForbiddenKeyPrefixes` match at the start of any segment of the key, so an imported key such
+      # as `search.repos.index` counts too. `AllowedKeys` takes strings, matched exactly, and regular
+      # expressions, for keys such as a read-only query repo.
+      #
+      # @example
+      #   # bad
+      #   class Actions::Users::Create < App::Action
+      #     include Deps["repos.user_repo"]
+      #
+      #     def handle(request, response)
+      #       user_repo.create(request.params[:user])
+      #     end
+      #   end
+      #
+      #   # good
+      #   class Actions::Users::Create < App::Action
+      #     include Deps["operations.create_user"]
+      #
+      #     def handle(request, response)
+      #       create_user.call(request.params[:user])
+      #     end
+      #   end
+      #
+      # @example AllowedKeys: ['repos.user_queries']
+      #   # good
+      #   include Deps["repos.user_queries"]
+      class PersistenceInAction < Base
+        include DepsKeys
+
+        MSG = "Call an operation instead of `%<key>s` from an action."
+        RESTRICT_ON_SEND = %i[include].freeze
+
+        def on_send(node)
+          deps_arguments(node) do |arguments|
+            each_deps_key(arguments) do |key_node, _name|
+              add_offense(key_node, message: format(MSG, key: key_node.value)) if forbidden?(key_node.value)
+            end
+          end
+        end
+
+        private
+
+        def allowed?(key)
+          Array(cop_config["AllowedKeys"]).any? do |pattern|
+            pattern.is_a?(Regexp) ? pattern.match?(key) : pattern == key
+          end
+        end
+
+        def forbidden?(key)
+          return false if allowed?(key)
+
+          Array(cop_config["ForbiddenKeyPrefixes"]).any? do |prefix|
+            key.start_with?(prefix) || key.include?(".#{prefix}")
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/hanami/provider_top_level_require.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Hanami
+      # Checks for `require` and `require_relative` in a provider file outside `prepare` and
+      # `start`. A top-level `require` runs when the file loads. Inside `prepare`, it runs only when
+      # the provider prepares, as the Hanami guides show.
+      #
+      # @example
+      #   # bad
+      #   require "sidekiq"
+      #
+      #   Hanami.app.register_provider(:sidekiq) do
+      #     start do
+      #       register "sidekiq", Sidekiq
+      #     end
+      #   end
+      #
+      #   # good
+      #   Hanami.app.register_provider(:sidekiq) do
+      #     prepare do
+      #       require "sidekiq"
+      #     end
+      #
+      #     start do
+      #       register "sidekiq", Sidekiq
+      #     end
+      #   end
+      class ProviderTopLevelRequire < Base
+        MSG = "Move `%<require>s` into `prepare`."
+        RESTRICT_ON_SEND = %i[require require_relative].freeze
+
+        def on_send(node)
+          return unless node.receiver.nil?
+
+          block = node.each_ancestor(:any_block).first
+          return if block && %i[prepare start].include?(block.method_name)
+
+          add_offense(node, message: format(MSG, require: node.source))
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/hanami/relation_outside_repo.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Hanami
+      # Checks for a relation, or the ROM container that hands them out, in `include Deps[...]`
+      # outside a repo. Repos are the boundary to the database. When an action, operation or view
+      # queries a relation, query logic spreads across layers and the repo stops being the one place
+      # to change it.
+      #
+      # `RelationKeyPrefixes` names the start of a relation's key, and `ROMKeys` names the keys of
+      # the ROM container.
+      #
+      # @example
+      #   # bad
+      #   class Operations::ListUsers
+      #     include Deps["relations.users"]
+      #
+      #     def call = users.where(active: true).to_a
+      #   end
+      #
+      #   # good
+      #   class Operations::ListUsers
+      #     include Deps["repos.user_repo"]
+      #
+      #     def call = user_repo.active
+      #   end
+      class RelationOutsideRepo < Base
+        include DepsKeys
+
+        MSG = "Use `%<key>s` only from a repo."
+        RESTRICT_ON_SEND = %i[include].freeze
+
+        def on_send(node)
+          deps_arguments(node) do |arguments|
+            each_deps_key(arguments) do |key_node, _name|
+              add_offense(key_node, message: format(MSG, key: key_node.value)) if relation?(key_node.value)
+            end
+          end
+        end
+
+        private
+
+        def relation?(key)
+          Array(cop_config["RelationKeyPrefixes"]).any? { |prefix| key.start_with?(prefix) } ||
+            Array(cop_config["ROMKeys"]).include?(key)
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/hanami/slice_exports.rb

@@ -84,7 +84,7 @@ module RuboCop
         def message_for(key)
           return MSG_FORBIDDEN if matches?("ForbiddenExports", key)
 
-          MSG_NOT_ALLOWED if cop_config.key?("AllowedExports") && !matches?("AllowedExports", key)
+          MSG_NOT_ALLOWED if Array(cop_config["AllowedExports"]).any? && !matches?("AllowedExports", key)
         end
 
         def slice_class?(node)

data/lib/rubocop/cop/hanami/slice_namespace.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Hanami
+      # Checks that each top-level `module` and `class` in a file under `slices/<name>/` opens the
+      # slice's namespace. Zeitwerk expects `slices/admin/actions/users/index.rb` to define
+      # `Admin::Actions::Users::Index`. A mismatch raises at load time, often far from the file at
+      # fault.
+      #
+      # The cop camelizes the slice's directory the way Hanami does, word by word, so `admin_panel`
+      # gives `AdminPanel`, and checks only the first segment of each name. It reads the acronyms in
+      # `config/app.rb`, so `inflections.acronym "TMAS"` turns `tmas_gate_counts` into `TMASGateCounts`.
+      # `Inflections` adds to them, keyed by word or by whole slice name. For nested slices, the
+      # innermost one counts.
+      #
+      # @example
+      #   # slices/admin/actions/users/index.rb
+      #
+      #   # bad
+      #   module Backoffice
+      #     module Actions
+      #     end
+      #   end
+      #
+      #   # good
+      #   module Admin
+      #     module Actions
+      #     end
+      #   end
+      #
+      # @example Inflections: { api: API }
+      #   # slices/api/action.rb
+      #
+      #   # good
+      #   class API::Action < MyApp::Action
+      #   end
+      class SliceNamespace < Base
+        MSG = "Files in `slices/%<slice>s` belong in the `%<namespace>s` namespace."
+        SLICE = %r{(?:\A|/)slices/([^/]+)(?=/)}
+
+        def_node_search :acronyms, "(send _ :acronym $...)"
+
+        # Lets RuboCop's result cache drop stale results when the app's inflections change.
+        def external_dependency_checksum
+          path = app_config_path
+          Digest::SHA1.hexdigest(File.read(path)) if File.file?(path)
+        end
+
+        def on_new_investigation
+          slice = slice_name
+          return unless slice && processed_source.ast
+
+          namespace = namespace_for(slice)
+          top_level_definitions.each do |definition|
+            next if root_name(definition.identifier) == namespace
+
+            add_offense(definition.identifier, message: format(MSG, slice: slice, namespace: namespace))
+          end
+        end
+
+        private
+
+        # Hanami camelizes a slice's name with its parent's inflector. Only the app's is read, so a nested
+        # slice ignores acronyms set in its parent slice.
+        def app_acronyms
+          ast = app_config_ast
+          return {} unless ast
+
+          words = acronyms(ast).to_a.flatten.select { |arg| arg.type?(:str, :sym) }
+          words.to_h { |word| [word.value.to_s.downcase, word.value.to_s] }
+        end
+
+        def app_config_ast
+          path = app_config_path
+          return unless File.file?(path)
+
+          source = processed_source
+          ProcessedSource.from_file(path, source.ruby_version, parser_engine: source.parser_engine).ast
+        end
+
+        def app_config_path
+          File.join(config.base_dir_for_path_parameters, "config", "app.rb")
+        end
+
+        def namespace_for(slice)
+          rules = app_acronyms.merge(cop_config["Inflections"] || {})
+          rules.fetch(slice) { slice.split("_").map { |word| rules.fetch(word) { word.capitalize } }.join }.to_s
+        end
+
+        def root_name(const)
+          const = const.namespace while const.namespace&.const_type?
+          const.short_name.to_s
+        end
+
+        def slice_name
+          processed_source.file_path.to_s.scan(SLICE).last&.first
+        end
+
+        def top_level_definitions
+          ast = processed_source.ast
+          (ast.begin_type? ? ast.children : [ast]).select { |node| node.type?(:module, :class) }
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/hanami/unused_deps.rb

@@ -0,0 +1,137 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Hanami
+      # Checks for a key in `include Deps[...]` whose accessor the class never reads. A stale
+      # dependency still gets resolved, still boots its provider and still shows up as a constructor
+      # argument.
+      #
+      # A read is a bare call or a call on `self`, the instance variable the kwargs strategy sets,
+      # `send`, `public_send`, `__send__` or `method` with a literal symbol, or a keyword argument
+      # of `initialize` read outside `super`. The cop skips a class
+      # that passes `Deps` anything but literal keys, or calls `send` with a name it can't read. It
+      # skips modules, since `include Deps` in a module serves whatever class includes it.
+      #
+      # A dependency also counts as used when a parent class, a subclass at any depth, or a mixin of
+      # either reads it. The cop indexes the classes and modules under `app`, `lib` and `slices` to
+      # follow them, and stops at constants the project doesn't define, such as `Hanami::Action`. It
+      # skips the class if one of them calls `send` with a name it can't read.
+      #
+      # It still flags a dependency read somewhere it can't follow. Disable it with a comment on that
+      # key, or name it in `AllowedNames` to never flag it.
+      #
+      # @example
+      #   # bad
+      #   class Operations::CreateUser
+      #     include Deps["repos.user_repo", "mailers.welcome"]
+      #
+      #     def call(input)
+      #       user_repo.create(input)
+      #     end
+      #   end
+      #
+      #   # good
+      #   class Operations::CreateUser
+      #     include Deps["repos.user_repo"]
+      #
+      #     def call(input)
+      #       user_repo.create(input)
+      #     end
+      #   end
+      #
+      # @example AllowedNames: [contract]
+      #   # good
+      #   class Operations::SaveTask < MyApp::Operation
+      #     include Deps[contract: "contracts.task"]
+      #   end
+      class UnusedDeps < Base
+        include DepsKeys
+
+        MSG = "`%<name>s` from `Deps[\"%<key>s\"]` is never used."
+
+        def_node_matcher :dynamic_send?, "(send _ {:send :public_send :__send__} !sym ...)"
+        def_node_search :initializers, "(def :initialize ...)"
+        def_node_matcher :literal_send, "(send _ {:send :public_send :__send__ :method} (sym $_) ...)"
+
+        # Lets RuboCop's result cache drop stale results when a parent class or mixin changes.
+        def external_dependency_checksum
+          RuboCop::Hanami::ClassIndex.checksum(config.base_dir_for_path_parameters)
+        end
+
+        def on_class(node)
+          arguments = deps_arguments_in(node)
+          return unless checkable?(node, arguments)
+
+          unused = unused_keys(arguments, used_names(node) + Array(cop_config["AllowedNames"]))
+          return if unused.empty?
+
+          related = related_reads(node)
+          return unless related
+
+          unused.each do |key_node, name|
+            add_offense(key_node, message: format(MSG, name: name, key: key_node.value)) unless related.include?(name)
+          end
+        end
+
+        private
+
+        def checkable?(node, arguments)
+          return false if arguments.empty? || !arguments.all? { |argument| literal?(argument) }
+
+          node.each_descendant(:send).none? { |send| dynamic_send?(send) }
+        end
+
+        def class_index
+          RuboCop::Hanami::ClassIndex.for(config.base_dir_for_path_parameters, processed_source) do |node|
+            used_names(node) if node.each_descendant(:send).none? { |send| dynamic_send?(send) }
+          end
+        end
+
+        def deps_arguments_in(node)
+          body = node.body
+          children = body&.begin_type? ? body.children : [body]
+          children.compact.filter_map { |child| deps_arguments(child) }.flatten
+        end
+
+        # Passing a keyword on to `super` doesn't count, since the kwargs strategy needs that to inject it.
+        def keyword_reads(method)
+          keywords = method.arguments.select { |argument| argument.type?(:kwarg, :kwoptarg) }.map(&:name)
+          reads = method.each_descendant(:lvar).select { |lvar| lvar.each_ancestor(:super).none? }.map(&:name)
+          (keywords & reads).map(&:to_s)
+        end
+
+        def literal?(argument)
+          argument.str_type? || (argument.hash_type? && argument.pairs.all? { |pair| literal_alias?(pair) })
+        end
+
+        def read_name(read)
+          return read.children.first.to_s.delete_prefix("@") if read.ivar_type?
+
+          literal_send(read)&.to_s || (read.method_name.to_s if read.receiver.nil? || read.receiver.self_type?)
+        end
+
+        # The names every parent, child and mixin of `node` reads, or nil when one of them reads names
+        # the cop can't see.
+        def related_reads(node)
+          index = class_index
+          reads = index.related(index.definition(node, nil)).map(&:reads)
+          reads.sum(Set[]) if reads.all?
+        end
+
+        def unused_keys(arguments, used)
+          unused = []
+          each_deps_key(arguments) do |key_node, name|
+            unused << [key_node, name] unless name.nil? || used.include?(name)
+          end
+          unused
+        end
+
+        def used_names(node)
+          reads = node.each_descendant(:send, :ivar).to_set { |read| read_name(read) }
+          reads.merge(initializers(node).flat_map { |method| keyword_reads(method) })
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/hanami/unvalidated_params.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Hanami
+      # Checks for a key read from `request.params` in an action that declares no `params` or
+      # `contract`. Without a schema, `request.params` holds raw input: strings, any keys, no
+      # coercion.
+      #
+      # The cop reads `[]`, `fetch` and `dig` on the params of the first argument of `handle`,
+      # whatever it is named. It can't see a `params` declared in a parent action, so
+      # `AllowedParentClasses` names validated base classes whose subclasses it skips.
+      #
+      # @example
+      #   # bad
+      #   class Actions::Users::Show < App::Action
+      #     def handle(request, response)
+      #       id = request.params[:id]
+      #     end
+      #   end
+      #
+      #   # good
+      #   class Actions::Users::Show < App::Action
+      #     params do
+      #       required(:id).filled(:integer)
+      #     end
+      #
+      #     def handle(request, response)
+      #       halt 422 unless request.params.valid?
+      #
+      #       id = request.params[:id]
+      #     end
+      #   end
+      class UnvalidatedParams < Base
+        MSG = "Declare `params` or `contract` before reading `request.params`."
+
+        def_node_matcher :schema?, "{(send nil? {:params :contract} _) (block (send nil? {:params :contract}) ...)}"
+        def_node_matcher :params_read?, "(send (send (lvar %1) :params) {:[] :fetch :dig} ...)"
+
+        def on_def(node)
+          request = node.arguments.first if node.method?(:handle)
+          return unless request&.arg_type? && unvalidated?(node.each_ancestor(:class, :module, :sclass).first)
+
+          node.each_descendant(:send) { |send| add_offense(send) if params_read?(send, request.name) }
+        end
+
+        private
+
+        def allowed_parent?(scope)
+          parent = scope.parent_class
+          parent&.const_type? && Array(cop_config["AllowedParentClasses"]).include?(parent.const_name)
+        end
+
+        def declares_schema?(scope)
+          body = scope.body
+          (body&.begin_type? ? body.children : [body]).any? { |child| child && schema?(child) }
+        end
+
+        def unvalidated?(scope)
+          scope&.class_type? && !allowed_parent?(scope) && !declares_schema?(scope)
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/hanami/unwrapped_step.rb

@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Hanami
+      # Checks for a call to a method that returns a Result, in an operation's flow, that isn't
+      # passed to `step`. dry-operation halts on failure only through `step`. A bare call drops the
+      # `Failure` and the flow carries on as if it worked.
+      #
+      # With no types to go on, the cop works within one class. A method returns a Result when its
+      # last expression, or a `return`, is `Success(...)` or `Failure(...)`. A flow method is one of
+      # `FlowMethods` or a name the class passes to `operate_on`. The cop skips a call whose value
+      # is assigned, used as a receiver or passed on. It can't see Results from injected
+      # dependencies.
+      #
+      # @example
+      #   # bad
+      #   class Operations::CreateUser < App::Operation
+      #     def call(input)
+      #       validate(input)
+      #       user_repo.create(input)
+      #     end
+      #
+      #     private
+      #
+      #     def validate(input)
+      #       input[:email] ? Success(input) : Failure(:no_email)
+      #     end
+      #   end
+      #
+      #   # good
+      #   class Operations::CreateUser < App::Operation
+      #     def call(input)
+      #       attrs = step validate(input)
+      #       step create(attrs)
+      #     end
+      #   end
+      class UnwrappedStep < Base
+        MSG = "`%<name>s` returns a Result; wrap it in `step`."
+
+        def_node_matcher :result?, "(send nil? {:Success :Failure} ...)"
+        def_node_search :operate_on, "(send nil? :operate_on $...)"
+
+        def on_class(node)
+          defs = node.each_descendant(:def).to_a
+          results = defs.select { |defn| returns_result?(defn) }.to_set(&:method_name)
+          return if results.empty?
+
+          flows = flow_methods(node)
+          defs.select { |defn| flows.include?(defn.method_name) }.each { |defn| check_flow(defn, results) }
+        end
+
+        private
+
+        def check_flow(defn, results)
+          defn.each_descendant(:send) do |send|
+            next unless send.receiver.nil? && results.include?(send.method_name) && statement?(send)
+
+            add_offense(send, message: format(MSG, name: send.method_name))
+          end
+        end
+
+        def flow_methods(node)
+          names = operate_on(node).flat_map { |arguments| arguments.select(&:sym_type?).map(&:value) }
+          (Array(cop_config["FlowMethods"]).map(&:to_sym) + names).to_set
+        end
+
+        def returns_result?(defn)
+          defn.each_descendant(:return).any? { |ret| ret.children.first && result?(ret.children.first) } ||
+            tail_result?(defn.body)
+        end
+
+        def statement?(send)
+          parent = send.parent
+          parent.type?(:begin, :kwbegin) || (parent.type?(:def, :any_block) && parent.body.equal?(send))
+        end
+
+        def tail_result?(node)
+          return result?(node) if node&.send_type?
+
+          case node&.type
+          when :begin, :kwbegin then tail_result?(node.children.last)
+          when :if, :case then node.branches.any? { |branch| tail_result?(branch) }
+          else false
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/hanami/class_index.rb

@@ -0,0 +1,153 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Hanami
+    # Indexes the classes and modules defined under a project's `app`, `lib` and `slices`, so a cop can
+    # follow a class to the parents and mixins it inherits from, and to the classes that inherit from
+    # it, across files.
+    class ClassIndex
+      extend NodePattern::Macros
+
+      GLOB = "{app,lib,slices}/**/*.rb"
+      # ponytail: rescans at most once a second, so a language server may lint against a one second old
+      # project. Watch files instead if that ever matters.
+      TTL = 1
+
+      # `parents` holds each superclass or mixin as written, with the lexical scopes to resolve it in.
+      # `reads` is the set of names the body reads, or nil when it reads names the cop can't see.
+      Definition = Struct.new(:name, :parents, :reads)
+
+      def_node_matcher :mixin_arguments, "(send nil? {:include :prepend} $...)"
+
+      @indexes = {}
+
+      class << self
+        # Changes whenever a file under the indexed roots is added, removed or touched.
+        def checksum(root)
+          Digest::SHA1.hexdigest(Dir.glob(GLOB, base: root).sort.map { |path| "#{path}#{mtime(root, path)}" }.join)
+        end
+
+        # One index per project root, shared by every file in the run. `reads` takes a class or module
+        # node and returns its Definition#reads.
+        def for(root, processed_source, &reads)
+          index = @indexes[root] ||= new(root, processed_source, reads)
+          index.refresh
+          index
+        end
+
+        def mtime(root, path)
+          File.mtime(File.join(root, path)).to_f
+        rescue Errno::ENOENT
+          nil
+        end
+
+        # The constant's full name, as Module#name would give it.
+        def name_of(node)
+          name = node.identifier.source
+          return name.delete_prefix("::") if name.start_with?("::")
+
+          outer = node.each_ancestor(:class, :module).first
+          outer ? "#{name_of(outer)}::#{name}" : name
+        end
+
+        # The full names of the classes and modules around `node`, innermost first.
+        def scopes_of(node)
+          node.each_ancestor(:class, :module).map { |scope| name_of(scope) }
+        end
+      end
+
+      def initialize(root, processed_source, reads)
+        @root = root
+        @ruby_version = processed_source.ruby_version
+        @parser_engine = processed_source.parser_engine
+        @reads = reads
+        @files = {}
+      end
+
+      # Every definition `definition` inherits from, through superclasses and mixins, that the project
+      # defines. A constant from outside the project, such as `Hanami::Action`, ends the walk.
+      def ancestors(definition, seen = Set[definition.name])
+        definition.parents.flat_map do |constant, scopes|
+          name = resolve(constant, scopes, definition.name)
+          next [] unless name && seen.add?(name)
+
+          @definitions[name].flat_map { |parent| [parent, *ancestors(parent, seen)] }
+        end
+      end
+
+      # Every definition that inherits from `name`, at any depth.
+      def descendants(name, seen = Set[name])
+        @children.fetch(name, []).flat_map do |child|
+          seen.add?(child.name) ? [child, *descendants(child.name, seen)] : []
+        end
+      end
+
+      def definition(node, reads = @reads.call(node))
+        name = self.class.name_of(node)
+        scopes = self.class.scopes_of(node)
+        parents = mixins(node).map { |constant| [constant.source, [name, *scopes]] }
+        parents.unshift([node.parent_class.source, scopes]) if node.class_type? && node.parent_class&.const_type?
+        Definition.new(name, parents, reads)
+      end
+
+      # Parses only the files added or touched since the last scan.
+      def refresh
+        now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        return if @checked_at && now - @checked_at < TTL
+
+        @checked_at = now
+        @files = Dir.glob(GLOB, base: @root).to_h { |path| [path, file_entry(path)] }
+        definitions = @files.values.flat_map(&:last)
+        @definitions = definitions.group_by(&:name)
+        @children = children_of(definitions)
+      end
+
+      # Everything whose reads count for `definition`: its ancestors, its descendants, and the ancestors
+      # of those descendants, such as a mixin a subclass includes.
+      def related(definition)
+        family = [definition, *descendants(definition.name)]
+        (family.drop(1) + family.flat_map { |member| ancestors(member) }).uniq
+      end
+
+      private
+
+      def children_of(definitions)
+        children = Hash.new { |hash, name| hash[name] = [] }
+        definitions.each do |child|
+          child.parents.each do |constant, scopes|
+            name = resolve(constant, scopes, child.name)
+            children[name] << child if name
+          end
+        end
+        children
+      end
+
+      def file_entry(path)
+        mtime = self.class.mtime(@root, path)
+        cached = @files[path]
+        cached&.first == mtime ? cached : [mtime, parse(path)]
+      end
+
+      def mixins(node)
+        body = node.body
+        children = body&.begin_type? ? body.children : [body]
+        children.compact.flat_map { |child| mixin_arguments(child) || [] }.select(&:const_type?)
+      end
+
+      def parse(path)
+        ast = ProcessedSource.from_file(File.join(@root, path), @ruby_version, parser_engine: @parser_engine).ast
+        ast ? ast.each_node(:class, :module).map { |node| definition(node) } : []
+      rescue Errno::ENOENT
+        []
+      end
+
+      # Looks the constant up the way Ruby would, from the innermost scope out, skipping the class that
+      # names it so `class Operation < Operation` finds the outer one.
+      def resolve(constant, scopes, skip)
+        candidates = [*scopes.map { |scope| "#{scope}::#{constant}" }, constant]
+        candidates = [constant.delete_prefix("::")] if constant.start_with?("::")
+        candidates.find { |name| name != skip && @definitions.key?(name) }
+      end
+    end
+  end
+end

data/lib/rubocop-hanami.rb

@@ -2,5 +2,19 @@
 
 require "rubocop"
 
+require_relative "rubocop/hanami/class_index"
 require_relative "rubocop/hanami/plugin"
+require_relative "rubocop/cop/hanami/mixin/deps_keys"
+
+require_relative "rubocop/cop/hanami/action_call_override"
+require_relative "rubocop/cop/hanami/app_reference_in_slice"
+require_relative "rubocop/cop/hanami/container_lookup"
+require_relative "rubocop/cop/hanami/env_access"
+require_relative "rubocop/cop/hanami/persistence_in_action"
+require_relative "rubocop/cop/hanami/provider_top_level_require"
+require_relative "rubocop/cop/hanami/relation_outside_repo"
 require_relative "rubocop/cop/hanami/slice_exports"
+require_relative "rubocop/cop/hanami/slice_namespace"
+require_relative "rubocop/cop/hanami/unused_deps"
+require_relative "rubocop/cop/hanami/unvalidated_params"
+require_relative "rubocop/cop/hanami/unwrapped_step"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rubocop-hanami
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Aaron Allen
@@ -48,7 +48,20 @@ files:
 - LICENSE
 - config/default.yml
 - lib/rubocop-hanami.rb
+- lib/rubocop/cop/hanami/action_call_override.rb
+- lib/rubocop/cop/hanami/app_reference_in_slice.rb
+- lib/rubocop/cop/hanami/container_lookup.rb
+- lib/rubocop/cop/hanami/env_access.rb
+- lib/rubocop/cop/hanami/mixin/deps_keys.rb
+- lib/rubocop/cop/hanami/persistence_in_action.rb
+- lib/rubocop/cop/hanami/provider_top_level_require.rb
+- lib/rubocop/cop/hanami/relation_outside_repo.rb
 - lib/rubocop/cop/hanami/slice_exports.rb
+- lib/rubocop/cop/hanami/slice_namespace.rb
+- lib/rubocop/cop/hanami/unused_deps.rb
+- lib/rubocop/cop/hanami/unvalidated_params.rb
+- lib/rubocop/cop/hanami/unwrapped_step.rb
+- lib/rubocop/hanami/class_index.rb
 - lib/rubocop/hanami/plugin.rb
 homepage: https://github.com/aaronmallen/rubocop-hanami
 licenses: