sequra-style 1.18.0 → 1.19.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c3cb23d52c4f8f874a5aad9ee232ab2b3de754fa4c993fe9a24575072f134d99
-  data.tar.gz: 0014151bbc9f819fdedf44f7604f2a47fa7e3e320873e501138f5c75886750fb
+  metadata.gz: 47e2880848be7928ef68435e320055b4d2003f4b321d172094fa77f123f5139e
+  data.tar.gz: d8ef008a1b7ba0477c45a19d52eb965d86a994fe5c7c203c67ecc2941f2ac798
 SHA512:
-  metadata.gz: d9ef0de4f838e0be3c4f2413ab7496aa8fa96baf5eb10026cc01a822112d1e51bd0428032b7505de0ef6f3922f77d840c0c9eda081098dfea559d01d3b6641cb
-  data.tar.gz: cf6170ea43e2aa6f3a03da557bb43927ec72f3ac48bbdefa55f7059426803b96f8439b603f3246df45347505ceb7311e0e0091dc3ea120d9b0c64b06469c8aca
+  metadata.gz: 19d7b3760cf692ed282a02b99416f5d3e6f9fc288a8f5ecf8086e40459215f8665c27fc90f336183e42dcc37823668364a9d8503fa8a462b3afc5ad0d68885cb
+  data.tar.gz: 17bd16a9f9499060f4ee8e986c0f7a12e32a5a1f5d28ba494b9b5ca2d6ac8e78dda03254ea83d75c8073bc7823c60a738f171dd492e76910269fd41f1f5574da

data/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.19.0](https://github.com/sequra/sequra-style/compare/v1.18.0...v1.19.0) (2026-07-29)
+
+
+### Features
+
+* [COR-1992] Flag mailer .later stubs in NoSidekiqPerformStubs ([#81](https://github.com/sequra/sequra-style/issues/81)) ([b9ea46e](https://github.com/sequra/sequra-style/commit/b9ea46e97649b40aae30bfa4f6cbbc51fe0c72f0))
+
 ## [1.18.0](https://github.com/sequra/sequra-style/compare/v1.17.0...v1.18.0) (2026-07-28)
 
 

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    sequra-style (1.18.0)
+    sequra-style (1.19.0)
       rubocop (~> 1.75)
       rubocop-performance (~> 1.25)
       rubocop-rails (~> 2.31)

data/lib/rubocop/cop/sequra/no_sidekiq_perform_stubs.rb

@@ -2,7 +2,8 @@ module RuboCop
   module Cop
     module Sequra
       # Detects RSpec stubs and spy assertions on Sidekiq enqueue methods
-      # (`perform_async`, `perform_at`, `perform_in`).
+      # (`perform_async`, `perform_at`, `perform_in`) and on the mailer
+      # enqueue wrapper (`SomeMailer.later`).
       #
       # Stubbing these methods bypasses `Sidekiq.strict_args!` validation,
       # which lets symbol-keyed hashes (and other non-JSON-native types)
@@ -12,12 +13,19 @@ module RuboCop
       # rescue-swallowers can mask the failure. This pattern caused a
       # silent push-notification drop in COR-1923.
       #
+      # `SomeMailer.later` (seQura's `ApplicationMailer.later`) is the
+      # standard mailer enqueue path and funnels through
+      # `ApplicationMailerJob.perform_async`, so stubbing it bypasses
+      # `strict_args!` exactly like stubbing `perform_async` directly.
+      # `.later` is only flagged when the stubbed subject is a `*Mailer`
+      # constant, so unrelated `.later` methods are left alone.
+      #
       # Use `have_enqueued_sidekiq_job` (or `change(SomeJob.jobs, :size)`)
       # instead. Both go through Sidekiq's client middleware chain, so
       # `strict_args!` validates the arguments as it would in production.
       #
       # `.and_call_original` is exempt: the stub spies on the call but
-      # then runs the real `perform_*`, which still exercises the
+      # then runs the real method, which still exercises the
       # serialization contract.
       #
       # @example
@@ -33,6 +41,9 @@ module RuboCop
       #   # bad - spy verification on a stubbed enqueue
       #   expect(SomeJob).to have_received(:perform_async).with(id)
       #
+      #   # bad - mailer enqueue wrapper bypasses strict_args! too
+      #   allow(WelcomeMailer).to receive(:later)
+      #
       #   # good - exercises strict_args! through Sidekiq's middleware
       #   expect(SomeJob).to have_enqueued_sidekiq_job(id, name: "value")
       #
@@ -43,17 +54,23 @@ module RuboCop
       #   expect(SomeJob).to receive(:perform_async).and_call_original
       #
       class NoSidekiqPerformStubs < Base
-        MSG = "Avoid stubbing Sidekiq enqueue methods (`perform_async`/`perform_at`/`perform_in`). " \
-              "Stubs bypass `Sidekiq.strict_args!` validation and can hide symbol-keyed hash bugs " \
-              "(see COR-1923). Use `have_enqueued_sidekiq_job` or `change(Job.jobs, :size)` instead. " \
-              "Use `.and_call_original` only as an escape hatch.".freeze
+        MSG = "Avoid stubbing job/mailer enqueue methods (`perform_async`/`perform_at`/`perform_in`, " \
+              "or `Mailer.later`). Stubs bypass `Sidekiq.strict_args!` validation and can hide " \
+              "symbol-keyed hash bugs (see COR-1923). Use `have_enqueued_sidekiq_job` or " \
+              "`change(Job.jobs, :size)` instead. Use `.and_call_original` only as an escape hatch.".freeze
+
+        SUBJECT_WRAPPERS = [:allow, :expect, :allow_any_instance_of, :expect_any_instance_of].freeze
 
         def_node_matcher :perform_method_stub?, <<~PATTERN
           (send nil? {:receive :have_received} (sym {:perform_async :perform_at :perform_in}))
         PATTERN
 
+        def_node_matcher :later_method_stub?, <<~PATTERN
+          (send nil? {:receive :have_received} (sym :later))
+        PATTERN
+
         def on_send(node)
-          return unless perform_method_stub?(node)
+          return unless perform_method_stub?(node) || mailer_later_stub?(node)
           return if chained_with_call_original?(node)
 
           add_offense(node)
@@ -61,6 +78,26 @@ module RuboCop
 
         private
 
+        def mailer_later_stub?(node)
+          return false unless later_method_stub?(node)
+
+          subject = stubbed_subject(node)
+          subject&.const_type? && subject.const_name.to_s.end_with?("Mailer")
+        end
+
+        def stubbed_subject(node)
+          current = node
+          current = current.parent while current.parent&.send_type? && current.parent.receiver == current
+
+          matcher = current.parent
+          return unless matcher&.send_type?
+
+          wrapper = matcher.receiver
+          return unless wrapper&.send_type? && SUBJECT_WRAPPERS.include?(wrapper.method_name)
+
+          wrapper.first_argument
+        end
+
         def chained_with_call_original?(node)
           current = node
           loop do

data/lib/sequra/style/version.rb

@@ -1,5 +1,5 @@
 module Sequra
   module Style
-    VERSION = "1.18.0"
+    VERSION = "1.19.0"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sequra-style
 version: !ruby/object:Gem::Version
-  version: 1.18.0
+  version: 1.19.0
 platform: ruby
 authors:
 - Sequra engineering
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-07-28 00:00:00.000000000 Z
+date: 2026-07-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rubocop