sorbet-runtime 0.5.5316 → 0.5.5956

data/lib/types/props/decorator.rb

@@ -12,7 +12,7 @@ class T::Props::Decorator
 
   Rules = T.type_alias {T::Hash[Symbol, T.untyped]}
   DecoratedInstance = T.type_alias {Object} # Would be T::Props, but that produces circular reference errors in some circumstances
-  PropType = T.type_alias {T.any(T::Types::Base, T::Props::CustomType)}
+  PropType = T.type_alias {T::Types::Base}
   PropTypeOrClass = T.type_alias {T.any(PropType, Module)}
 
   class NoRulesError < StandardError; end
@@ -20,7 +20,7 @@ class T::Props::Decorator
   EMPTY_PROPS = T.let({}.freeze, T::Hash[Symbol, Rules])
   private_constant :EMPTY_PROPS
 
-  sig {params(klass: T.untyped).void}
+  sig {params(klass: T.untyped).void.checked(:never)}
   def initialize(klass)
     @class = T.let(klass, T.all(Module, T::Props::ClassMethods))
     @class.plugins.each do |mod|
@@ -66,7 +66,7 @@ class T::Props::Decorator
     without_accessors
     clobber_existing_method!
     extra
-    optional
+    setter_validate
     _tnilable
   }.map {|k| [k, true]}.to_h.freeze, T::Hash[Symbol, T::Boolean])
   private_constant :VALID_RULE_KEYS
@@ -118,6 +118,21 @@ class T::Props::Decorator
   end
   alias_method :set, :prop_set
 
+  # Only Models have any custom get logic but we need to call this on
+  # non-Models since we don't know at code gen time what we have.
+  sig do
+    params(
+      instance: DecoratedInstance,
+      prop: Symbol,
+      value: T.untyped
+    )
+    .returns(T.untyped)
+    .checked(:never)
+  end
+  def prop_get_logic(instance, prop, value)
+    value
+  end
+
   # For performance, don't use named params here.
   # Passing in rules here is purely a performance optimization.
   #
@@ -173,7 +188,7 @@ class T::Props::Decorator
     .returns(T.untyped)
     .checked(:never)
   end
-  def foreign_prop_get(instance, prop, foreign_class, rules=props[prop.to_sym], opts={})
+  def foreign_prop_get(instance, prop, foreign_class, rules=prop_rules(prop), opts={})
     return if !(value = prop_get(instance, prop, rules))
     T.unsafe(foreign_class).load(value, {}, opts)
   end
@@ -204,12 +219,6 @@ class T::Props::Decorator
       raise ArgumentError.new("At least one invalid prop arg supplied in #{self}: #{rules.keys.inspect}")
     end
 
-    if (array = rules[:array])
-      unless array.is_a?(Module)
-        raise ArgumentError.new("Bad class as subtype in prop #{@class.name}.#{name}: #{array.inspect}")
-      end
-    end
-
     if !(rules[:clobber_existing_method!]) && !(rules[:without_accessors])
       if BANNED_METHOD_NAMES.include?(name.to_sym)
         raise ArgumentError.new(
@@ -229,10 +238,12 @@ class T::Props::Decorator
     nil
   end
 
+  SAFE_NAME = /\A[A-Za-z_][A-Za-z0-9_-]*\z/
+
   # Used to validate both prop names and serialized forms
   sig {params(name: T.any(Symbol, String)).void}
   private def validate_prop_name(name)
-    if !name.match?(/\A[A-Za-z_][A-Za-z0-9_-]*\z/)
+    if !name.match?(SAFE_NAME)
       raise ArgumentError.new("Invalid prop name in #{@class.name}: #{name}")
     end
   end
@@ -277,47 +288,6 @@ class T::Props::Decorator
   end
   def prop_defined(name, cls, rules={})
     cls = T::Utils.resolve_alias(cls)
-    if rules[:optional] == true
-      T::Configuration.hard_assert_handler(
-        'Use of `optional: true` is deprecated, please use `T.nilable(...)` instead.',
-        storytime: {
-          name: name,
-          cls_or_args: cls.to_s,
-          args: rules,
-          klass: decorated_class.name,
-        },
-      )
-    elsif rules[:optional] == false
-      T::Configuration.hard_assert_handler(
-        'Use of `optional: :false` is deprecated as it\'s the default value.',
-        storytime: {
-          name: name,
-          cls_or_args: cls.to_s,
-          args: rules,
-          klass: decorated_class.name,
-        },
-      )
-    elsif rules[:optional] == :on_load
-      T::Configuration.hard_assert_handler(
-        'Use of `optional: :on_load` is deprecated. You probably want `T.nilable(...)` with :raise_on_nil_write instead.',
-        storytime: {
-          name: name,
-          cls_or_args: cls.to_s,
-          args: rules,
-          klass: decorated_class.name,
-        },
-      )
-    elsif rules[:optional] == :existing
-      T::Configuration.hard_assert_handler(
-        'Use of `optional: :existing` is not allowed: you should use use T.nilable (http://go/optional)',
-        storytime: {
-          name: name,
-          cls_or_args: cls.to_s,
-          args: rules,
-          klass: decorated_class.name,
-        },
-      )
-    end
 
     if T::Utils::Nilable.is_union_with_nilclass(cls)
       # :_tnilable is introduced internally for performance purpose so that clients do not need to call
@@ -332,21 +302,13 @@ class T::Props::Decorator
     if !cls.is_a?(Module)
       cls = convert_type_to_class(cls)
     end
-    type_object = type
-    if !(type_object.singleton_class < T::Props::CustomType)
-      type_object = smart_coerce(type_object, array: rules[:array], enum: rules[:enum])
-    end
+    type_object = smart_coerce(type, enum: rules[:enum])
 
     prop_validate_definition!(name, cls, rules, type_object)
 
     # Retrive the possible underlying object with T.nilable.
-    underlying_type_object = T::Utils::Nilable.get_underlying_type_object(type_object)
     type = T::Utils::Nilable.get_underlying_type(type)
 
-    array_subdoc_type = array_subdoc_type(underlying_type_object)
-    hash_value_subdoc_type = hash_value_subdoc_type(underlying_type_object)
-    hash_key_custom_type = hash_key_custom_type(underlying_type_object)
-
     sensitivity_and_pii = {sensitivity: rules[:sensitivity]}
     if defined?(Opus) && defined?(Opus::Sensitivity) && defined?(Opus::Sensitivity::Utils)
       sensitivity_and_pii = Opus::Sensitivity::Utils.normalize_sensitivity_and_pii_annotation(sensitivity_and_pii)
@@ -364,27 +326,11 @@ class T::Props::Decorator
       end
     end
 
-    needs_clone =
-      if cls <= Array || cls <= Hash || cls <= Set
-        shallow_clone_ok(underlying_type_object) ? :shallow : true
-      else
-        false
-      end
-
     rules = rules.merge(
       # TODO: The type of this element is confusing. We should refactor so that
       # it can be always `type_object` (a PropType) or always `cls` (a Module)
       type: type,
-      # These are precomputed for performance
-      # TODO: A lot of these are only needed by T::Props::Serializable or T::Struct
-      # and can/should be moved accordingly.
-      type_is_custom_type: cls.singleton_class < T::Props::CustomType,
-      type_is_serializable: cls < T::Props::Serializable,
-      type_is_array_of_serializable: !array_subdoc_type.nil?,
-      type_is_hash_of_serializable_values: !hash_value_subdoc_type.nil?,
-      type_is_hash_of_custom_type_keys: !hash_key_custom_type.nil?,
       type_object: type_object,
-      type_needs_clone: needs_clone,
       accessor_key: "@#{name}".to_sym,
       sensitivity: sensitivity_and_pii[:sensitivity],
       pii: sensitivity_and_pii[:pii],
@@ -394,26 +340,13 @@ class T::Props::Decorator
 
     validate_not_missing_sensitivity(name, rules)
 
-    # for backcompat
-    if type.is_a?(T::Types::TypedArray) && type.type.is_a?(T::Types::Simple)
-      rules[:array] = type.type.raw_type
-    elsif array_subdoc_type
-      rules[:array] = array_subdoc_type
-    end
-
-    if rules[:type_is_serializable]
-      rules[:serializable_subtype] = cls
-    elsif array_subdoc_type
-      rules[:serializable_subtype] = array_subdoc_type
-    elsif hash_value_subdoc_type && hash_key_custom_type
-      rules[:serializable_subtype] = {
-        keys: hash_key_custom_type,
-        values: hash_value_subdoc_type,
-      }
-    elsif hash_value_subdoc_type
-      rules[:serializable_subtype] = hash_value_subdoc_type
-    elsif hash_key_custom_type
-      rules[:serializable_subtype] = hash_key_custom_type
+    # for backcompat (the `:array` key is deprecated but because the name is
+    # so generic it's really hard to be sure it's not being relied on anymore)
+    if type.is_a?(T::Types::TypedArray)
+      inner = T::Utils::Nilable.get_underlying_type(type.type)
+      if inner.is_a?(Module)
+        rules[:array] = inner
+      end
     end
 
     rules[:setter_proc] = T::Props::Private::SetterFactory.build_setter_proc(@class, name, rules).freeze
@@ -429,7 +362,7 @@ class T::Props::Decorator
     end
 
     handle_foreign_option(name, cls, rules, rules[:foreign]) if rules[:foreign]
-    handle_foreign_hint_only_option(cls, rules[:foreign_hint_only]) if rules[:foreign_hint_only]
+    handle_foreign_hint_only_option(name, cls, rules[:foreign_hint_only]) if rules[:foreign_hint_only]
     handle_redaction_option(name, rules[:redaction]) if rules[:redaction]
   end
 
@@ -459,110 +392,22 @@ class T::Props::Decorator
     end
   end
 
-  # returns the subdoc of the array type, or nil if it's not a Document type
-  #
-  # checked(:never) - Typechecks internally
-  sig do
-    params(type: PropType)
-    .returns(T.nilable(Module))
-    .checked(:never)
-  end
-  private def array_subdoc_type(type)
-    if type.is_a?(T::Types::TypedArray)
-      el_type = T::Utils.unwrap_nilable(type.type) || type.type
-
-      if el_type.is_a?(T::Types::Simple) &&
-          (el_type.raw_type < T::Props::Serializable || el_type.raw_type.is_a?(T::Props::CustomType))
-        return el_type.raw_type
-      end
-    end
-
-    nil
-  end
-
-  # returns the subdoc of the hash value type, or nil if it's not a Document type
-  #
-  # checked(:never) - Typechecks internally
-  sig do
-    params(type: PropType)
-    .returns(T.nilable(Module))
-    .checked(:never)
-  end
-  private def hash_value_subdoc_type(type)
-    if type.is_a?(T::Types::TypedHash)
-      values_type = T::Utils.unwrap_nilable(type.values) || type.values
-
-      if values_type.is_a?(T::Types::Simple) &&
-          (values_type.raw_type < T::Props::Serializable || values_type.raw_type.is_a?(T::Props::CustomType))
-        return values_type.raw_type
-      end
-    end
-
-    nil
-  end
-
-  # returns the type of the hash key, or nil. Any CustomType could be a key, but we only expect T::Enum right now.
-  #
-  # checked(:never) - Typechecks internally
   sig do
-    params(type: PropType)
-    .returns(T.nilable(Module))
-    .checked(:never)
-  end
-  private def hash_key_custom_type(type)
-    if type.is_a?(T::Types::TypedHash)
-      keys_type = T::Utils.unwrap_nilable(type.keys) || type.keys
-
-      if keys_type.is_a?(T::Types::Simple) && keys_type.raw_type.is_a?(T::Props::CustomType)
-        return keys_type.raw_type
-      end
-    end
-
-    nil
-  end
-
-  # From T::Props::Utils.deep_clone_object, plus String
-  TYPES_NOT_NEEDING_CLONE = T.let([TrueClass, FalseClass, NilClass, Symbol, String, Numeric], T::Array[Module])
-
-  # checked(:never) - Typechecks internally
-  sig {params(type: PropType).returns(T.nilable(T::Boolean)).checked(:never)}
-  private def shallow_clone_ok(type)
-    inner_type =
-      if type.is_a?(T::Types::TypedArray)
-        type.type
-      elsif type.is_a?(T::Types::TypedSet)
-        type.type
-      elsif type.is_a?(T::Types::TypedHash)
-        type.values
-      end
-
-    inner_type.is_a?(T::Types::Simple) && TYPES_NOT_NEEDING_CLONE.any? do |cls|
-      inner_type.raw_type <= cls
-    end
-  end
-
-  sig do
-    params(type: PropTypeOrClass, array: T.untyped, enum: T.untyped)
+    params(type: PropTypeOrClass, enum: T.untyped)
     .returns(T::Types::Base)
   end
-  private def smart_coerce(type, array:, enum:)
+  private def smart_coerce(type, enum:)
     # Backwards compatibility for pre-T::Types style
-    if !array.nil? && !enum.nil?
-      raise ArgumentError.new("Cannot specify both :array and :enum options")
-    elsif !array.nil?
-      if type == Set
-        T::Set[array]
-      else
-        T::Array[array]
-      end
-    elsif !enum.nil?
-      if T::Utils.unwrap_nilable(type)
-        T.nilable(T.enum(enum))
+    type = T::Utils.coerce(type)
+    if enum.nil?
+      type
+    else
+      nonnil_type = T::Utils.unwrap_nilable(type)
+      if nonnil_type
+        T.nilable(T.all(nonnil_type, T.enum(enum)))
       else
-        T.enum(enum)
+        T.all(type, T.enum(enum))
       end
-    else
-      T::Utils.coerce(type)
     end
   end
 
@@ -582,7 +427,7 @@ class T::Props::Decorator
       # TODO(PRIVACYENG-982) Ideally we'd also check for 'password' and possibly
       # other terms, but this interacts badly with ProtoDefinedDocument because
       # the proto syntax currently can't declare "sensitivity: []"
-      if prop_name =~ /\bsecret\b/
+      if /\bsecret\b/.match?(prop_name)
         T::Configuration.hard_assert_handler(
           "#{@class}##{prop_name} has the word 'secret' in its name, but no " \
           "'sensitivity:' annotation. This is probably wrong, because if a " \
@@ -599,7 +444,7 @@ class T::Props::Decorator
   sig do
     params(
       prop_name: Symbol,
-      redaction: Chalk::Tools::RedactionUtils::RedactionDirectiveSpec,
+      redaction: T.untyped,
     )
     .void
   end
@@ -636,12 +481,13 @@ class T::Props::Decorator
 
   sig do
     params(
+      prop_name: Symbol,
       prop_cls: Module,
       foreign_hint_only: T.untyped,
     )
     .void
   end
-  private def handle_foreign_hint_only_option(prop_cls, foreign_hint_only)
+  private def handle_foreign_hint_only_option(prop_name, prop_cls, foreign_hint_only)
     if ![String, Array].include?(prop_cls) && !(prop_cls.is_a?(T::Props::CustomType))
       raise ArgumentError.new(
         "`foreign_hint_only` can only be used with String or Array prop types"
@@ -652,6 +498,21 @@ class T::Props::Decorator
       :foreign_hint_only, foreign_hint_only,
       valid_type_msg: "an individual or array of a model class, or a Proc returning such."
     )
+
+    unless foreign_hint_only.is_a?(Proc)
+      T::Configuration.soft_assert_handler(<<~MESSAGE, storytime: {prop: prop_name, value: foreign_hint_only}, notify: 'jerry')
+        Please use a Proc that returns a model class instead of the model class itself as the argument to `foreign_hint_only`. In other words:
+
+          instead of `prop :foo, String, foreign_hint_only: FooModel`
+          use `prop :foo, String, foreign_hint_only: -> {FooModel}`
+
+          OR
+
+          instead of `prop :foo, String, foreign_hint_only: [FooModel, BarModel]`
+          use `prop :foo, String, foreign_hint_only: -> {[FooModel, BarModel]}`
+
+      MESSAGE
+    end
   end
 
   # checked(:never) - Rules hash is expensive to check
@@ -705,14 +566,6 @@ class T::Props::Decorator
       end
       loaded_foreign
     end
-
-    @class.send(:define_method, "#{prop_name}_record") do |allow_direct_mutation: nil|
-      T::Configuration.soft_assert_handler(
-        "Using deprecated 'model.#{prop_name}_record' foreign key syntax. You should replace this with 'model.#{prop_name}_'",
-        notify: 'vasi'
-      )
-      send(fk_method, allow_direct_mutation: allow_direct_mutation)
-    end
   end
 
   # checked(:never) - Rules hash is expensive to check
@@ -745,6 +598,16 @@ class T::Props::Decorator
       )
     end
 
+    unless foreign.is_a?(Proc)
+      T::Configuration.soft_assert_handler(<<~MESSAGE, storytime: {prop: prop_name, value: foreign}, notify: 'jerry')
+        Please use a Proc that returns a model class instead of the model class itself as the argument to `foreign`. In other words:
+
+          instead of `prop :foo, String, foreign: FooModel`
+          use `prop :foo, String, foreign: -> {FooModel}`
+
+      MESSAGE
+    end
+
     define_foreign_method(prop_name, rules, foreign)
   end
 

data/lib/types/props/generated_code_validation.rb

@@ -0,0 +1,268 @@
+# frozen_string_literal: true
+# typed: true
+
+module T::Props
+  # Helper to validate generated code, to mitigate security concerns around
+  # `class_eval`. Not called by default; the expectation is this will be used
+  # in a test iterating over all T::Props::Serializable subclasses.
+  #
+  # We validate the exact expected structure of the generated methods as far
+  # as we can, and then where cloning produces an arbitrarily nested structure,
+  # we just validate a lack of side effects.
+  module GeneratedCodeValidation
+    extend Private::Parse
+
+    class ValidationError < RuntimeError; end
+
+    def self.validate_deserialize(source)
+      parsed = parse(source)
+
+      # def %<name>(hash)
+      #   ...
+      # end
+      assert_equal(:def, parsed.type)
+      name, args, body = parsed.children
+      assert_equal(:__t_props_generated_deserialize, name)
+      assert_equal(s(:args, s(:arg, :hash)), args)
+
+      assert_equal(:begin, body.type)
+      init, *prop_clauses, ret = body.children
+
+      # found = %<prop_count>
+      # ...
+      # found
+      assert_equal(:lvasgn, init.type)
+      init_name, init_val = init.children
+      assert_equal(:found, init_name)
+      assert_equal(:int, init_val.type)
+      assert_equal(s(:lvar, :found), ret)
+
+      prop_clauses.each_with_index do |clause, i|
+        if i % 2 == 0
+          validate_deserialize_hash_read(clause)
+        else
+          validate_deserialize_ivar_set(clause)
+        end
+      end
+    end
+
+    def self.validate_serialize(source)
+      parsed = parse(source)
+
+      # def %<name>(strict)
+      # ...
+      # end
+      assert_equal(:def, parsed.type)
+      name, args, body = parsed.children
+      assert_equal(:__t_props_generated_serialize, name)
+      assert_equal(s(:args, s(:arg, :strict)), args)
+
+      assert_equal(:begin, body.type)
+      init, *prop_clauses, ret = body.children
+
+      # h = {}
+      # ...
+      # h
+      assert_equal(s(:lvasgn, :h, s(:hash)), init)
+      assert_equal(s(:lvar, :h), ret)
+
+      prop_clauses.each do |clause|
+        validate_serialize_clause(clause)
+      end
+    end
+
+    private_class_method def self.validate_serialize_clause(clause)
+      assert_equal(:if, clause.type)
+      condition, if_body, else_body = clause.children
+
+      # if @%<accessor_key>.nil?
+      assert_equal(:send, condition.type)
+      receiver, method = condition.children
+      assert_equal(:ivar, receiver.type)
+      assert_equal(:nil?, method)
+
+      unless if_body.nil?
+        # required_prop_missing_from_serialize(%<prop>) if strict
+        assert_equal(:if, if_body.type)
+        if_strict_condition, if_strict_body, if_strict_else = if_body.children
+        assert_equal(s(:lvar, :strict), if_strict_condition)
+        assert_equal(:send, if_strict_body.type)
+        on_strict_receiver, on_strict_method, on_strict_arg = if_strict_body.children
+        assert_equal(nil, on_strict_receiver)
+        assert_equal(:required_prop_missing_from_serialize, on_strict_method)
+        assert_equal(:sym, on_strict_arg.type)
+        assert_equal(nil, if_strict_else)
+      end
+
+      # h[%<serialized_form>] = ...
+      assert_equal(:send, else_body.type)
+      receiver, method, h_key, h_val = else_body.children
+      assert_equal(s(:lvar, :h), receiver)
+      assert_equal(:[]=, method)
+      assert_equal(:str, h_key.type)
+
+      validate_lack_of_side_effects(h_val, whitelisted_methods_for_serialize)
+    end
+
+    private_class_method def self.validate_deserialize_hash_read(clause)
+      # val = hash[%<serialized_form>s]
+
+      assert_equal(:lvasgn, clause.type)
+      name, val = clause.children
+      assert_equal(:val, name)
+      assert_equal(:send, val.type)
+      receiver, method, arg = val.children
+      assert_equal(s(:lvar, :hash), receiver)
+      assert_equal(:[], method)
+      assert_equal(:str, arg.type)
+    end
+
+    private_class_method def self.validate_deserialize_ivar_set(clause)
+      # %<accessor_key>s = if val.nil?
+      #   found -= 1 unless hash.key?(%<serialized_form>s)
+      #   %<nil_handler>s
+      # else
+      #   %<serialized_val>s
+      # end
+
+      assert_equal(:ivasgn, clause.type)
+      ivar_name, deser_val = clause.children
+      unless ivar_name.is_a?(Symbol)
+        raise ValidationError.new("Unexpected ivar: #{ivar_name}")
+      end
+
+      assert_equal(:if, deser_val.type)
+      condition, if_body, else_body = deser_val.children
+      assert_equal(s(:send, s(:lvar, :val), :nil?), condition)
+
+      assert_equal(:begin, if_body.type)
+      update_found, handle_nil = if_body.children
+      assert_equal(:if, update_found.type)
+      found_condition, found_if_body, found_else_body = update_found.children
+      assert_equal(:send, found_condition.type)
+      receiver, method, arg = found_condition.children
+      assert_equal(s(:lvar, :hash), receiver)
+      assert_equal(:key?, method)
+      assert_equal(:str, arg.type)
+      assert_equal(nil, found_if_body)
+      assert_equal(s(:op_asgn, s(:lvasgn, :found), :-, s(:int, 1)), found_else_body)
+
+      validate_deserialize_handle_nil(handle_nil)
+
+      if else_body.type == :kwbegin
+        rescue_expression, = else_body.children
+        assert_equal(:rescue, rescue_expression.type)
+
+        try, rescue_body = rescue_expression.children
+        validate_lack_of_side_effects(try, whitelisted_methods_for_deserialize)
+
+        assert_equal(:resbody, rescue_body.type)
+        exceptions, assignment, handler =  rescue_body.children
+        assert_equal(:array, exceptions.type)
+        exceptions.children.each {|c| assert_equal(:const, c.type)}
+        assert_equal(:lvasgn, assignment.type)
+        assert_equal([:e], assignment.children)
+        validate_lack_of_side_effects(handler, whitelisted_methods_for_deserialize)
+      else
+        validate_lack_of_side_effects(else_body, whitelisted_methods_for_deserialize)
+      end
+    end
+
+    private_class_method def self.validate_deserialize_handle_nil(node)
+      case node.type
+      when :hash, :array, :str, :sym, :int, :float, :true, :false, :nil, :const # rubocop:disable Lint/BooleanSymbol
+        # Primitives and constants are safe
+      when :send
+        receiver, method, arg = node.children
+        if receiver.nil?
+          # required_prop_missing_from_deserialize(%<prop>)
+          assert_equal(:required_prop_missing_from_deserialize, method)
+          assert_equal(:sym, arg.type)
+        elsif receiver == self_class_decorator
+          # self.class.decorator.raise_nil_deserialize_error(%<serialized_form>)
+          assert_equal(:raise_nil_deserialize_error, method)
+          assert_equal(:str, arg.type)
+        elsif method == :default
+          # self.class.decorator.props_with_defaults.fetch(%<prop>).default
+          assert_equal(:send, receiver.type)
+          inner_receiver, inner_method, inner_arg = receiver.children
+          assert_equal(
+            s(:send, self_class_decorator, :props_with_defaults),
+            inner_receiver,
+          )
+          assert_equal(:fetch, inner_method)
+          assert_equal(:sym, inner_arg.type)
+        else
+          raise ValidationError.new("Unexpected receiver in nil handler: #{node.inspect}")
+        end
+      else
+        raise ValidationError.new("Unexpected nil handler: #{node.inspect}")
+      end
+    end
+
+    private_class_method def self.self_class_decorator
+      @self_class_decorator ||= s(:send, s(:send, s(:self), :class), :decorator).freeze
+    end
+
+    private_class_method def self.validate_lack_of_side_effects(node, whitelisted_methods_by_receiver_type)
+      case node.type
+      when :const
+        # This is ok, because we'll have validated what method has been called
+        # if applicable
+      when :hash, :array, :str, :sym, :int, :float, :true, :false, :nil, :self # rubocop:disable Lint/BooleanSymbol
+        # Primitives & self are ok
+      when :lvar, :arg, :ivar
+        # Reading local & instance variables & arguments is ok
+        unless node.children.all? {|c| c.is_a?(Symbol)}
+          raise ValidationError.new("Unexpected child for #{node.type}: #{node.inspect}")
+        end
+      when :args, :mlhs, :block, :begin, :if
+        # Blocks etc are read-only if their contents are read-only
+        node.children.each {|c| validate_lack_of_side_effects(c, whitelisted_methods_by_receiver_type) if c}
+      when :send
+        # Sends are riskier so check a whitelist
+        receiver, method, *args = node.children
+        if receiver
+          if receiver.type == :send
+            key = receiver
+          else
+            key = receiver.type
+            validate_lack_of_side_effects(receiver, whitelisted_methods_by_receiver_type)
+          end
+
+          if !whitelisted_methods_by_receiver_type[key]&.include?(method)
+            raise ValidationError.new("Unexpected method #{method} called on #{receiver.inspect}")
+          end
+        end
+        args.each do |arg|
+          validate_lack_of_side_effects(arg, whitelisted_methods_by_receiver_type)
+        end
+      else
+        raise ValidationError.new("Unexpected node type #{node.type}: #{node.inspect}")
+      end
+    end
+
+    private_class_method def self.assert_equal(expected, actual)
+      if expected != actual
+        raise ValidationError.new("Expected #{expected}, got #{actual}")
+      end
+    end
+
+    # Method calls generated by SerdeTransform
+    private_class_method def self.whitelisted_methods_for_serialize
+      @whitelisted_methods_for_serialize ||= {
+        :lvar => %i{dup map transform_values transform_keys each_with_object nil? []= serialize},
+        :ivar => %i{dup map transform_values transform_keys each_with_object serialize},
+        :const => %i{checked_serialize deep_clone_object},
+      }
+    end
+
+    # Method calls generated by SerdeTransform
+    private_class_method def self.whitelisted_methods_for_deserialize
+      @whitelisted_methods_for_deserialize ||= {
+        :lvar => %i{dup map transform_values transform_keys each_with_object nil? []= to_f},
+        :const => %i{deserialize from_hash deep_clone_object soft_assert_handler},
+      }
+    end
+  end
+end