schema_reaper 1.0.14 → 1.0.15

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6f169920afef1838471a418e29ad207b6c9d3193ef57caf6678cf68d675a3405
-  data.tar.gz: 3e5d507411e727278004def7a752db662620a01371625ce761af4495fd020f2e
+  metadata.gz: 6b327fade324c6f2e9a871da57ae46814c1b077a1aca3aec64ca6681f270ffe6
+  data.tar.gz: d63156d86d7dc44e92204475c3d23ffa7e6b87730d0a436dc9aefd041ea8b843
 SHA512:
-  metadata.gz: 739b0cf29def40063c3a182ad5b9d207f7409f9277e134e76bd980bc3db276a333f225a1974bf5c30a3e14af769d0c8128efeb46961d084f1349fc17bddd6eca
-  data.tar.gz: 692ed7533e2553ebbc9085001f1d805519149fe988860e23da9902b941de60c292a8918e60f2fe9c2d0e558aaeacd182d31e6376570e7ea9e8551977d5856db8
+  metadata.gz: cb3fe82c18f9f198ec544089305b183f2a413123093edd6f437a04c8d0b32879c123d1e4d1c338a1e03539a8eb16847406bb21f4eab5932ed6b4aba4fcdf461e
+  data.tar.gz: 1c1cf99e43ff66383f5b3bb0c42d5cfec209cbc8dab3bb986e734b6dcf75706c5ed1ecbf09d61f116ce2883957630f0ceeff7a102fb49793fe73cd93cd8283ad

data/CHANGELOG.md

@@ -1,5 +1,49 @@
 # Changelog
 
+## [1.0.15] - 2026-09-18
+
+### Fixed
+- **`dead_column` still missed the two gems its own macro-detection feature
+  named as motivation.** 1.0.14 added recognition for `has_secure_password`,
+  `attr_encrypted`, and Lockbox macro columns, but only the first actually
+  worked. `attr_encrypted`'s real default column naming is a *prefix*
+  (`encrypted_<attr>`), confirmed against the gem's own
+  `attr_encrypted_default_options`; the feature generated a suffix guess
+  that never matched it. Lockbox's real macro is `has_encrypted`; the
+  feature checked for `lockbox_encrypts`, which is not a method that
+  exists in the gem, so it never even fired for genuine Lockbox code.
+  Rewritten as a macro-name -> column-template table so each macro's real
+  naming shape is expressed explicitly, and dropped an unnecessary
+  suffix guess for Rails' native `encrypts` (which stores ciphertext in
+  the original column and creates no extra one). Eight new specs cover
+  all four macros -- this had no test coverage before. (#15, mitkush)
+
+## [1.0.14] - 2026-09-18
+
+Published directly without a version-bump commit or tag; this entry
+reconciles the record after the fact. Confirmed by diffing the
+published gem against `main` at the time -- the only difference was the
+version string.
+
+### Fixed
+- `duplicate_index` respecting uniqueness and partial `WHERE` clauses --
+  see 1.0.13's entry for the underlying issue; this release adds the fix.
+  (#12, mitkush)
+- `dead_column` missing `has_secure_password`, `encrypts`, and
+  `attr_encrypted` macro columns -- a virtual attribute like
+  `has_secure_password` never has its generated column name
+  (`password_digest`) written anywhere in application code, so it looked
+  unreferenced. (aksshatt)
+
+### Known issue
+- The `attr_encrypted`/Lockbox part of the macro-column fix above does
+  not work as intended: it derives a suffix-based column name
+  (`<attr>_encrypted`) that does not match `attr_encrypted`'s actual
+  default naming (`encrypted_<attr>`, a prefix), and it references a
+  `lockbox_encrypts` macro name that does not exist in Lockbox -- the
+  gem's real method is `has_encrypted`. `has_secure_password` and Rails'
+  native `encrypts` are unaffected and work correctly. Tracked for 1.0.15.
+
 ## [1.0.13] - 2026-09-18
 
 ### Fixed

data/lib/schema_reaper/static/scanner.rb

@@ -12,15 +12,37 @@ module SchemaReaper
       RUBY_GLOB  = "**/*.rb"
       WORD_RE    = /[a-z_][a-z0-9_]*/i.freeze
 
-      # Macros that generate a real column from a differently-named virtual
-      # attribute, so the literal column name never appears in application
-      # code. Missing this made dead_column flag has_secure_password's
-      # password_digest, and attr_encrypted/Lockbox/KMS ciphertext columns,
-      # as unused even though they're the live backing store.
-      DIGEST_MACROS = %w[has_secure_password].freeze
-      DIGEST_SUFFIXES = %w[_digest].freeze
-      ENCRYPTED_MACROS = %w[encrypts attr_encrypted lockbox_encrypts].freeze
-      ENCRYPTED_SUFFIXES = %w[_ciphertext _iv _tag _encrypted].freeze
+      # Macros whose generated column name differs from the virtual attribute
+      # declared in the call, so the real column name never appears anywhere
+      # in application code and would otherwise look dead. %s is replaced with
+      # the declared attribute.
+      #
+      # Several shapes are listed for some macros on purpose: getting the real
+      # default right matters most, but an extra guess that never matches a
+      # real column is harmless -- over-collecting is this scanner's stated
+      # design, and both attr_encrypted and Lockbox let a call override their
+      # naming, which a static scan cannot always evaluate.
+      #
+      # attr_encrypted's own default is a PREFIX (encrypted_<attr>), not a
+      # suffix -- confirmed against the gem's own attr_encrypted_default_options
+      # (prefix: "encrypted_", suffix: ""). The suffix form is kept as a
+      # fallback for calls that override it.
+      #
+      # Lockbox's real macro is has_encrypted, not lockbox_encrypts.
+      #
+      # Rails' own `encrypts` has no entry: it stores ciphertext in the
+      # original column, so the bare attribute name is what needs to be
+      # "used", and that is already picked up as a symbol literal by
+      # tokens_for below -- do not add a suffix pattern for it.
+      MACRO_COLUMN_TEMPLATES = {
+        "has_secure_password" => ["%s_digest"],
+        "attr_encrypted" => ["encrypted_%s", "%s_encrypted", "%s_ciphertext"],
+        "has_encrypted" => ["%s_ciphertext", "%s_iv", "%s_tag"]
+      }.freeze
+
+      # The attribute a macro implies when called with no explicit name, e.g.
+      # bare `has_secure_password` -> :password.
+      MACRO_DEFAULT_ATTR = { "has_secure_password" => "password" }.freeze
 
       # Node classes whose #name (or #unescaped) is a bare identifier we treat
       # as a possible column/table reference.
@@ -89,24 +111,14 @@ module SchemaReaper
         end
       end
 
-      # `has_secure_password` / `encrypts :field` / `attr_encrypted :field`
-      # never write their generated column name (password_digest,
-      # field_ciphertext, ...) anywhere in source -- only the virtual
-      # attribute name. Derive the column names a macro call implies so they
-      # count as "used" instead of looking dead.
       def macro_derived_tokens(node)
         call_name = node.name&.to_s
-        return [] unless call_name
-
-        if DIGEST_MACROS.include?(call_name)
-          attrs = macro_symbol_args(node)
-          attrs = ["password"] if attrs.empty?
-          attrs.flat_map { |a| DIGEST_SUFFIXES.map { |s| "#{a}#{s}" } }
-        elsif ENCRYPTED_MACROS.include?(call_name)
-          macro_symbol_args(node).flat_map { |a| ENCRYPTED_SUFFIXES.map { |s| "#{a}#{s}" } }
-        else
-          []
-        end
+        templates = call_name && MACRO_COLUMN_TEMPLATES[call_name]
+        return [] unless templates
+
+        attrs = macro_symbol_args(node)
+        attrs = [MACRO_DEFAULT_ATTR[call_name]].compact if attrs.empty?
+        attrs.product(templates).map { |attr, template| format(template, attr) }
       end
 
       # Leading bare symbol arguments of a call, e.g. `encrypts :a, :b, purpose: :x`

data/lib/schema_reaper/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module SchemaReaper
-  VERSION = "1.0.14"
+  VERSION = "1.0.15"
 end

data/schema_reaper.gemspec

@@ -9,15 +9,17 @@ Gem::Specification.new do |spec|
   spec.email = ["akshatpegwar5@gmail.com", "mitanshukushwah@gmail.com"]
 
   spec.summary = "Find and safely remove schema dead-weight in Rails + PostgreSQL apps."
-  spec.description =
-    "schema_reaper finds schema dead-weight in Rails/ActiveRecord + PostgreSQL apps: " \
-    "dead columns and tables, unused, duplicate and missing foreign-key indexes, and " \
-    "always-NULL or single-value columns. It cross-references the live schema and pg_stats " \
-    "against a static scan of your code, with an optional production runtime signal for " \
-    "higher confidence. Each finding is scored, carries a reclaimable-bytes estimate, and " \
-    "ships with a staged, reversible migration. Reporters for terminal, JSON, Markdown and " \
-    "SARIF; a CI baseline gate; a trend log; a Rails railtie. PostgreSQL only for now; " \
-    "Ruby >= 2.7. See the README for full usage."
+  spec.description = <<~DESC.strip
+    schema_reaper scans a Rails + PostgreSQL app for schema debt that's easy to accumulate and hard to find by hand.
+
+    It checks your live database against your codebase and flags three kinds of problems: things nothing references anymore (dead columns and dead tables), index trouble (indexes nobody queries, indexes made redundant by a wider index that already covers them, and foreign-key columns with no index at all), and degenerate data (columns that are always NULL, or hold the exact same value in every row).
+
+    Every finding comes with a confidence score, an estimate of the disk space removing it would reclaim, and a concrete fix. For a column, that's a two-step migration: stop reading it first, then drop it once you've confirmed nothing broke. An optional runtime tracker can sample real production traffic to raise confidence further, for cases a static code scan alone can't settle.
+
+    Reports come as a colored terminal summary, JSON, Markdown for a PR comment, or SARIF for GitHub code scanning -- plus a CI baseline gate and a trend log to track progress release over release.
+
+    PostgreSQL only for now. Requires Ruby 2.7 or later. Full usage is in the README.
+  DESC
   spec.homepage = "https://github.com/aksshatt/schema_reaper"
   spec.license = "MIT"
   spec.required_ruby_version = ">= 2.7.0"

metadata

@@ -1,12 +1,12 @@
 --- !ruby/object:Gem::Specification
 name: schema_reaper
 version: !ruby/object:Gem::Version
-  version: 1.0.14
+  version: 1.0.15
 platform: ruby
 authors:
 - aksshatt
 - mitkush
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
 date: 2026-09-18 00:00:00.000000000 Z
@@ -79,14 +79,16 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.5'
-description: 'schema_reaper finds schema dead-weight in Rails/ActiveRecord + PostgreSQL
-  apps: dead columns and tables, unused, duplicate and missing foreign-key indexes,
-  and always-NULL or single-value columns. It cross-references the live schema and
-  pg_stats against a static scan of your code, with an optional production runtime
-  signal for higher confidence. Each finding is scored, carries a reclaimable-bytes
-  estimate, and ships with a staged, reversible migration. Reporters for terminal,
-  JSON, Markdown and SARIF; a CI baseline gate; a trend log; a Rails railtie. PostgreSQL
-  only for now; Ruby >= 2.7. See the README for full usage.'
+description: |-
+  schema_reaper scans a Rails + PostgreSQL app for schema debt that's easy to accumulate and hard to find by hand.
+
+  It checks your live database against your codebase and flags three kinds of problems: things nothing references anymore (dead columns and dead tables), index trouble (indexes nobody queries, indexes made redundant by a wider index that already covers them, and foreign-key columns with no index at all), and degenerate data (columns that are always NULL, or hold the exact same value in every row).
+
+  Every finding comes with a confidence score, an estimate of the disk space removing it would reclaim, and a concrete fix. For a column, that's a two-step migration: stop reading it first, then drop it once you've confirmed nothing broke. An optional runtime tracker can sample real production traffic to raise confidence further, for cases a static code scan alone can't settle.
+
+  Reports come as a colored terminal summary, JSON, Markdown for a PR comment, or SARIF for GitHub code scanning -- plus a CI baseline gate and a trend log to track progress release over release.
+
+  PostgreSQL only for now. Requires Ruby 2.7 or later. Full usage is in the README.
 email:
 - akshatpegwar5@gmail.com
 - mitanshukushwah@gmail.com
@@ -157,7 +159,7 @@ metadata:
   wiki_uri: https://github.com/aksshatt/schema_reaper/wiki
   funding_uri: https://github.com/sponsors/aksshatt
   rubygems_mfa_required: 'true'
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -172,8 +174,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.10
-signing_key: 
+rubygems_version: 3.3.3
+signing_key:
 specification_version: 4
 summary: Find and safely remove schema dead-weight in Rails + PostgreSQL apps.
 test_files: []