@blumintinc/eslint-plugin-blumint 1.12.5 → 1.13.0

package/lib/rules/enforce-firestore-facade.js

@@ -4,152 +4,68 @@ exports.enforceFirestoreFacade = void 0;
 const utils_1 = require("@typescript-eslint/utils");
 const createRule_1 = require("../utils/createRule");
 const FIRESTORE_METHODS = new Set(['get', 'set', 'update', 'delete']);
-const isMemberExpression = (node) => {
-    return node.type === utils_1.AST_NODE_TYPES.MemberExpression;
+const COLLECTION_CONSTRUCTORS = new Set(['Set', 'Map', 'WeakSet', 'WeakMap']);
+const KNOWN_FIRESTORE_ROOTS = new Set(['db', 'firestore']);
+const isMemberExpression = (node) => node.type === utils_1.AST_NODE_TYPES.MemberExpression;
+const isCallExpression = (node) => node.type === utils_1.AST_NODE_TYPES.CallExpression;
+const isIdentifier = (node) => node.type === utils_1.AST_NODE_TYPES.Identifier;
+const unwrapTSAsExpression = (node) => {
+    if (node.type === utils_1.AST_NODE_TYPES.TSAsExpression) {
+        return unwrapTSAsExpression(node.expression);
+    }
+    return node;
 };
-// Track variables that are assigned realtimeDb references
-const realtimeDbRefVariables = new Set();
-const realtimeDbChildVariables = new Set();
-const isRealtimeDbRefAssignment = (node) => {
-    if (node.type !== utils_1.AST_NODE_TYPES.VariableDeclarator)
-        return false;
-    const init = node.init;
-    if (!init)
-        return false;
-    // Check for direct realtimeDb.ref() assignments
-    // e.g., const ref = realtimeDb.ref(path);
-    if (init.type === utils_1.AST_NODE_TYPES.CallExpression &&
-        isMemberExpression(init.callee) &&
-        isIdentifier(init.callee.property) &&
-        init.callee.property.name === 'ref' &&
-        isIdentifier(init.callee.object) &&
-        (init.callee.object.name === 'realtimeDb' || init.callee.object.name.includes('realtimeDb'))) {
-        if (isIdentifier(node.id)) {
-            realtimeDbRefVariables.add(node.id.name);
-            return true;
+const getLeftmostIdentifier = (node) => {
+    let current = node
+        ? unwrapTSAsExpression(node)
+        : null;
+    while (current) {
+        if (isIdentifier(current)) {
+            return current;
         }
-    }
-    // Check for child() method calls on realtimeDb refs
-    // e.g., const childRef = parentRef.child('path');
-    if (init.type === utils_1.AST_NODE_TYPES.CallExpression &&
-        isMemberExpression(init.callee) &&
-        isIdentifier(init.callee.property) &&
-        init.callee.property.name === 'child' &&
-        isIdentifier(init.callee.object) &&
-        realtimeDbRefVariables.has(init.callee.object.name)) {
-        if (isIdentifier(node.id)) {
-            realtimeDbChildVariables.add(node.id.name);
-            return true;
+        if (isMemberExpression(current)) {
+            current = current.object;
+            continue;
         }
+        if (isCallExpression(current)) {
+            current = current.callee;
+            continue;
+        }
+        return null;
     }
-    return false;
-};
-const isRealtimeDbReference = (node) => {
-    // Check if it's a direct realtimeDb.ref() call
-    if (node.type === utils_1.AST_NODE_TYPES.CallExpression &&
-        isMemberExpression(node.callee) &&
-        isIdentifier(node.callee.property) &&
-        node.callee.property.name === 'ref' &&
-        isIdentifier(node.callee.object) &&
-        (node.callee.object.name === 'realtimeDb' || node.callee.object.name.includes('realtimeDb'))) {
-        return true;
-    }
-    // Check if it's a variable that holds a realtimeDb reference
-    if (isIdentifier(node)) {
-        return realtimeDbRefVariables.has(node.name) || realtimeDbChildVariables.has(node.name);
-    }
-    // Check if it's a child() call on a realtimeDb reference
-    if (node.type === utils_1.AST_NODE_TYPES.CallExpression &&
-        isMemberExpression(node.callee) &&
-        isIdentifier(node.callee.property) &&
-        node.callee.property.name === 'child' &&
-        isIdentifier(node.callee.object) &&
-        (realtimeDbRefVariables.has(node.callee.object.name) || realtimeDbChildVariables.has(node.callee.object.name))) {
-        return true;
-    }
-    return false;
+    return null;
 };
-const isFirestoreMethodCall = (node) => {
-    if (!isMemberExpression(node.callee))
-        return false;
-    const property = node.callee.property;
-    if (!isIdentifier(property) || !FIRESTORE_METHODS.has(property.name)) {
-        return false;
-    }
-    // Check if the method is called on a facade instance
-    const object = node.callee.object;
-    if (isIdentifier(object)) {
-        const name = object.name;
-        // Skip if it's a facade instance
-        if (name.includes('Fetcher') ||
-            name.includes('Setter') ||
-            name.includes('Tx')) {
-            return false;
-        }
-        // Skip if it's a realtimeDb reference variable
-        if (realtimeDbRefVariables.has(name) || realtimeDbChildVariables.has(name)) {
-            return false;
+const isFirestoreRoot = (node, firestoreCollectionVariables, firestoreDocRefVariables) => {
+    const baseIdentifier = getLeftmostIdentifier(node);
+    if (baseIdentifier) {
+        if (KNOWN_FIRESTORE_ROOTS.has(baseIdentifier.name)) {
+            return true;
         }
-        // Check for batch or transaction
-        if (/batch|transaction/i.test(name)) {
+        if (firestoreCollectionVariables.has(baseIdentifier.name) ||
+            firestoreDocRefVariables.has(baseIdentifier.name)) {
             return true;
         }
     }
-    // Check if the method is called on a realtimeDb reference
-    if (isRealtimeDbReference(object)) {
-        return false;
-    }
-    // Handle type assertions (as in the bug report)
-    if (object.type === utils_1.AST_NODE_TYPES.TSAsExpression) {
-        return true;
-    }
-    // Check if it's a Firestore reference
-    let current = object;
-    let foundDocOrCollection = false;
-    while (current) {
-        if (isCallExpression(current)) {
-            const callee = current.callee;
-            if (isMemberExpression(callee)) {
-                const property = callee.property;
-                if (isIdentifier(property)) {
-                    // Check for Firestore methods
-                    if (property.name === 'doc' || property.name === 'collection') {
-                        foundDocOrCollection = true;
-                        break;
-                    }
-                }
-            }
-        }
-        if (isMemberExpression(current)) {
-            current = current.object;
-        }
-        else if (current.type === utils_1.AST_NODE_TYPES.TSAsExpression) {
-            // Handle nested type assertions
-            current = current.expression;
-        }
-        else {
-            break;
+    if (isCallExpression(node) &&
+        isMemberExpression(node.callee) &&
+        isIdentifier(node.callee.property) &&
+        node.callee.property.name === 'firestore') {
+        const innerBase = getLeftmostIdentifier(node.callee.object);
+        if (innerBase &&
+            (innerBase.name === 'app' || KNOWN_FIRESTORE_ROOTS.has(innerBase.name))) {
+            return true;
         }
     }
-    // If we haven't found a doc/collection call yet, check if the object is a variable
-    if (!foundDocOrCollection && isIdentifier(object)) {
-        const name = object.name;
-        // If the variable name contains 'doc' or 'ref', it's likely a Firestore reference
-        // But exclude realtimeDb references
-        if ((name.toLowerCase().includes('doc') || name.toLowerCase().includes('ref')) &&
-            !name.includes('realtimeDb') &&
-            !realtimeDbRefVariables.has(name) &&
-            !realtimeDbChildVariables.has(name)) {
+    if (isMemberExpression(node) &&
+        isIdentifier(node.property) &&
+        node.property.name === 'firestore') {
+        const innerBase = getLeftmostIdentifier(node.object);
+        if (innerBase &&
+            (innerBase.name === 'app' || KNOWN_FIRESTORE_ROOTS.has(innerBase.name))) {
             return true;
         }
     }
-    return foundDocOrCollection;
-};
-const isCallExpression = (node) => {
-    return node.type === utils_1.AST_NODE_TYPES.CallExpression;
-};
-const isIdentifier = (node) => {
-    return node.type === utils_1.AST_NODE_TYPES.Identifier;
+    return false;
 };
 exports.enforceFirestoreFacade = (0, createRule_1.createRule)({
     name: 'enforce-firestore-facade',
@@ -161,21 +77,308 @@ exports.enforceFirestoreFacade = (0, createRule_1.createRule)({
         },
         schema: [],
         messages: {
-            noDirectGet: 'Use FirestoreFetcher or FirestoreDocFetcher instead of direct .get() calls',
-            noDirectSet: 'Use DocSetter or DocSetterTransaction instead of direct .set() calls',
-            noDirectUpdate: 'Use DocSetter or DocSetterTransaction instead of direct .update() calls',
-            noDirectDelete: 'Use DocSetter or DocSetterTransaction instead of direct .delete() calls',
+            noDirectGet: 'Direct Firestore "{{method}}" on {{target}} skips the Firestore fetcher facades that enforce typed deserialization, shared caching, and consistent error handling. Route reads through FirestoreFetcher or FirestoreDocFetcher so Firestore access stays observable and applies the shared safeguards.',
+            noDirectSet: 'Direct Firestore "{{method}}" on {{target}} bypasses DocSetter and DocSetterTransaction, which apply validation, merge semantics, and centralized retry/metrics. Send writes through DocSetter or DocSetterTransaction to keep Firestore writes consistent, auditable, and safer under load.',
+            noDirectUpdate: 'Direct Firestore "{{method}}" on {{target}} bypasses DocSetter and DocSetterTransaction, which guard partial updates with validation and shared retry/metrics. Use the setter facades for updates so field-level changes stay consistent with our Firestore write contract.',
+            noDirectDelete: 'Direct Firestore "{{method}}" on {{target}} bypasses DocSetter and DocSetterTransaction, which coordinate deletes with validation, retries, and any soft-delete policies. Perform deletes through the setter facades to avoid silent data loss and keep write telemetry intact.',
         },
     },
     defaultOptions: [],
     create(context) {
-        // Clear the sets at the beginning of each file analysis
-        realtimeDbRefVariables.clear();
-        realtimeDbChildVariables.clear();
+        const realtimeDbRefVariables = new Set();
+        const realtimeDbChildVariables = new Set();
+        const collectionObjectVariables = new Set();
+        const firestoreCollectionVariables = new Set();
+        const firestoreDocRefVariables = new Set();
+        const firestoreBatchVariables = new Set();
+        const firestoreTransactionVariables = new Set();
+        const docSetterVariables = new Set();
+        const batchManagerVariables = new Set();
+        const sourceCode = context.getSourceCode();
+        const clearFirestoreTrackingFor = (name) => {
+            firestoreDocRefVariables.delete(name);
+            firestoreCollectionVariables.delete(name);
+            firestoreBatchVariables.delete(name);
+            firestoreTransactionVariables.delete(name);
+            docSetterVariables.delete(name);
+            batchManagerVariables.delete(name);
+        };
+        const recordFirestoreVariable = (varName, expression) => {
+            const target = unwrapTSAsExpression(expression);
+            if (target.type === utils_1.AST_NODE_TYPES.ConditionalExpression) {
+                const matchedConsequent = recordFirestoreVariable(varName, target.consequent);
+                const matchedAlternate = recordFirestoreVariable(varName, target.alternate);
+                return matchedConsequent || matchedAlternate;
+            }
+            if (target.type === utils_1.AST_NODE_TYPES.LogicalExpression) {
+                return (recordFirestoreVariable(varName, target.left) ||
+                    recordFirestoreVariable(varName, target.right));
+            }
+            if (target.type === utils_1.AST_NODE_TYPES.SequenceExpression) {
+                const last = target.expressions[target.expressions.length - 1];
+                return last ? recordFirestoreVariable(varName, last) : false;
+            }
+            if (target.type === utils_1.AST_NODE_TYPES.NewExpression &&
+                isIdentifier(target.callee) &&
+                (target.callee.name === 'DocSetter' ||
+                    target.callee.name === 'DocSetterTransaction')) {
+                docSetterVariables.add(varName);
+                return true;
+            }
+            if (target.type === utils_1.AST_NODE_TYPES.NewExpression &&
+                isIdentifier(target.callee) &&
+                target.callee.name === 'BatchManager') {
+                batchManagerVariables.add(varName);
+                return true;
+            }
+            if (isFirestoreDocumentReference(target)) {
+                firestoreDocRefVariables.add(varName);
+                return true;
+            }
+            if (isFirestoreCollectionCall(target)) {
+                firestoreCollectionVariables.add(varName);
+                return true;
+            }
+            if (target.type === utils_1.AST_NODE_TYPES.CallExpression &&
+                isMemberExpression(target.callee) &&
+                isIdentifier(target.callee.property) &&
+                target.callee.property.name === 'batch' &&
+                isIdentifier(target.callee.object) &&
+                target.callee.object.name === 'db') {
+                firestoreBatchVariables.add(varName);
+                return true;
+            }
+            if (target.type === utils_1.AST_NODE_TYPES.Identifier &&
+                (target.name === 'transaction' || target.name === 'tx' || target.name === 't')) {
+                firestoreTransactionVariables.add(varName);
+                return true;
+            }
+            return false;
+        };
+        const isCollectionObjectAssignment = (node) => {
+            if (node.type !== utils_1.AST_NODE_TYPES.VariableDeclarator)
+                return false;
+            const init = node.init;
+            if (!init)
+                return false;
+            if (init.type === utils_1.AST_NODE_TYPES.NewExpression &&
+                isIdentifier(init.callee) &&
+                COLLECTION_CONSTRUCTORS.has(init.callee.name) &&
+                isIdentifier(node.id)) {
+                collectionObjectVariables.add(node.id.name);
+                return true;
+            }
+            return false;
+        };
+        const isFirestoreCollectionCall = (node) => {
+            const candidate = unwrapTSAsExpression(node);
+            if (!isCallExpression(candidate))
+                return false;
+            if (!isMemberExpression(candidate.callee))
+                return false;
+            const property = candidate.callee.property;
+            if (!isIdentifier(property) || property.name !== 'collection')
+                return false;
+            return isFirestoreRoot(candidate.callee.object, firestoreCollectionVariables, firestoreDocRefVariables);
+        };
+        const isFirestoreDocumentReference = (node) => {
+            const candidate = unwrapTSAsExpression(node);
+            if (!isCallExpression(candidate))
+                return false;
+            if (!isMemberExpression(candidate.callee))
+                return false;
+            const docProperty = candidate.callee.property;
+            if (!isIdentifier(docProperty) || docProperty.name !== 'doc')
+                return false;
+            const collectionCall = candidate.callee.object;
+            if (!isFirestoreCollectionCall(collectionCall)) {
+                return false;
+            }
+            return true;
+        };
+        const isFirestoreAssignment = (node) => {
+            if (node.type !== utils_1.AST_NODE_TYPES.VariableDeclarator)
+                return false;
+            const init = node.init;
+            if (!init || !isIdentifier(node.id))
+                return false;
+            return recordFirestoreVariable(node.id.name, init);
+        };
+        const handleAssignmentExpression = (node) => {
+            if (!isIdentifier(node.left))
+                return;
+            const varName = node.left.name;
+            const right = node.right;
+            clearFirestoreTrackingFor(varName);
+            recordFirestoreVariable(varName, right);
+        };
+        const isRealtimeDbRefAssignment = (node) => {
+            if (node.type !== utils_1.AST_NODE_TYPES.VariableDeclarator)
+                return false;
+            const init = node.init;
+            if (!init)
+                return false;
+            if (init.type === utils_1.AST_NODE_TYPES.CallExpression &&
+                isMemberExpression(init.callee) &&
+                isIdentifier(init.callee.property) &&
+                init.callee.property.name === 'ref' &&
+                isIdentifier(init.callee.object) &&
+                (init.callee.object.name === 'realtimeDb' ||
+                    init.callee.object.name.includes('realtimeDb')) &&
+                isIdentifier(node.id)) {
+                realtimeDbRefVariables.add(node.id.name);
+                return true;
+            }
+            if (init.type === utils_1.AST_NODE_TYPES.CallExpression &&
+                isMemberExpression(init.callee) &&
+                isIdentifier(init.callee.property) &&
+                init.callee.property.name === 'child' &&
+                isIdentifier(init.callee.object) &&
+                realtimeDbRefVariables.has(init.callee.object.name) &&
+                isIdentifier(node.id)) {
+                realtimeDbChildVariables.add(node.id.name);
+                return true;
+            }
+            return false;
+        };
+        const isRealtimeDbReference = (node) => {
+            if (node.type === utils_1.AST_NODE_TYPES.CallExpression &&
+                isMemberExpression(node.callee) &&
+                isIdentifier(node.callee.property) &&
+                node.callee.property.name === 'ref' &&
+                isIdentifier(node.callee.object) &&
+                (node.callee.object.name === 'realtimeDb' ||
+                    node.callee.object.name.includes('realtimeDb'))) {
+                return true;
+            }
+            if (isIdentifier(node)) {
+                return (realtimeDbRefVariables.has(node.name) ||
+                    realtimeDbChildVariables.has(node.name));
+            }
+            if (node.type === utils_1.AST_NODE_TYPES.CallExpression &&
+                isMemberExpression(node.callee) &&
+                isIdentifier(node.callee.property) &&
+                node.callee.property.name === 'child' &&
+                isIdentifier(node.callee.object) &&
+                (realtimeDbRefVariables.has(node.callee.object.name) ||
+                    realtimeDbChildVariables.has(node.callee.object.name))) {
+                return true;
+            }
+            return false;
+        };
+        const isTrackedFirestoreName = (name) => firestoreDocRefVariables.has(name) ||
+            firestoreBatchVariables.has(name) ||
+            firestoreTransactionVariables.has(name) ||
+            firestoreCollectionVariables.has(name);
+        const isFirestoreMethodCall = (node) => {
+            if (!isMemberExpression(node.callee))
+                return false;
+            const property = node.callee.property;
+            if (!isIdentifier(property) || !FIRESTORE_METHODS.has(property.name)) {
+                return false;
+            }
+            const object = node.callee.object;
+            if (isIdentifier(object)) {
+                const name = object.name;
+                if (docSetterVariables.has(name) ||
+                    batchManagerVariables.has(name) ||
+                    realtimeDbRefVariables.has(name) ||
+                    realtimeDbChildVariables.has(name) ||
+                    collectionObjectVariables.has(name)) {
+                    return false;
+                }
+                if (isTrackedFirestoreName(name)) {
+                    return true;
+                }
+                if (/^(batch|transaction)$/i.test(name)) {
+                    return true;
+                }
+                if ((name.toLowerCase().includes('doc') ||
+                    name.toLowerCase().includes('ref')) &&
+                    !name.includes('realtimeDb') &&
+                    !realtimeDbRefVariables.has(name) &&
+                    !realtimeDbChildVariables.has(name)) {
+                    return true;
+                }
+                return false;
+            }
+            if (isRealtimeDbReference(object)) {
+                return false;
+            }
+            if (isFirestoreDocumentReference(object)) {
+                return true;
+            }
+            if (object.type === utils_1.AST_NODE_TYPES.TSAsExpression) {
+                return isFirestoreMethodCall({
+                    ...node,
+                    callee: {
+                        ...node.callee,
+                        object: object.expression,
+                    },
+                });
+            }
+            if (object.type === utils_1.AST_NODE_TYPES.MemberExpression &&
+                object.computed &&
+                object.object.type === utils_1.AST_NODE_TYPES.Identifier) {
+                const arrayName = object.object.name;
+                if (isTrackedFirestoreName(arrayName) ||
+                    arrayName.toLowerCase().endsWith('refs')) {
+                    return true;
+                }
+                return false;
+            }
+            if (isMemberExpression(object)) {
+                let current = object;
+                while (isMemberExpression(current)) {
+                    if (isFirestoreDocumentReference(current) ||
+                        isFirestoreCollectionCall(current)) {
+                        return true;
+                    }
+                    current = current.object;
+                }
+            }
+            let current = object;
+            while (current) {
+                const unwrapped = unwrapTSAsExpression(current);
+                if (isCallExpression(unwrapped) &&
+                    isMemberExpression(unwrapped.callee) &&
+                    isIdentifier(unwrapped.callee.property)) {
+                    const propName = unwrapped.callee.property.name;
+                    if ((propName === 'doc' || propName === 'collection') &&
+                        (isFirestoreCollectionCall(unwrapped) ||
+                            isFirestoreRoot(unwrapped.callee.object, firestoreCollectionVariables, firestoreDocRefVariables))) {
+                        return true;
+                    }
+                    current = unwrapped.callee.object;
+                    continue;
+                }
+                if (isMemberExpression(unwrapped)) {
+                    current = unwrapped.object;
+                    continue;
+                }
+                break;
+            }
+            return false;
+        };
+        const reportDirectFirestoreCall = (messageId, node, method, callee) => {
+            const target = sourceCode.getText(callee.object);
+            context.report({
+                node,
+                messageId,
+                data: {
+                    method,
+                    target,
+                },
+            });
+        };
         return {
-            // Track variable declarations that are assigned realtimeDb references
             VariableDeclarator(node) {
                 isRealtimeDbRefAssignment(node);
+                isCollectionObjectAssignment(node);
+                isFirestoreAssignment(node);
+            },
+            AssignmentExpression(node) {
+                handleAssignmentExpression(node);
             },
             CallExpression(node) {
                 if (!isFirestoreMethodCall(node))
@@ -186,31 +389,18 @@ exports.enforceFirestoreFacade = (0, createRule_1.createRule)({
                 const property = callee.property;
                 if (!isIdentifier(property))
                     return;
-                // Report appropriate error based on method
                 switch (property.name) {
                     case 'get':
-                        context.report({
-                            node,
-                            messageId: 'noDirectGet',
-                        });
+                        reportDirectFirestoreCall('noDirectGet', node, property.name, callee);
                         break;
                     case 'set':
-                        context.report({
-                            node,
-                            messageId: 'noDirectSet',
-                        });
+                        reportDirectFirestoreCall('noDirectSet', node, property.name, callee);
                         break;
                     case 'update':
-                        context.report({
-                            node,
-                            messageId: 'noDirectUpdate',
-                        });
+                        reportDirectFirestoreCall('noDirectUpdate', node, property.name, callee);
                         break;
                     case 'delete':
-                        context.report({
-                            node,
-                            messageId: 'noDirectDelete',
-                        });
+                        reportDirectFirestoreCall('noDirectDelete', node, property.name, callee);
                         break;
                 }
             },

package/lib/rules/enforce-firestore-rules-get-access.d.ts

@@ -0,0 +1,3 @@
+type MessageIds = 'useGetAccess' | 'requireGetDefault';
+export declare const enforceFirestoreRulesGetAccess: import("@typescript-eslint/utils/dist/ts-eslint/Rule").RuleModule<MessageIds, [], import("@typescript-eslint/utils/dist/ts-eslint/Rule").RuleListener>;
+export {};

package/lib/rules/enforce-firestore-rules-get-access.js

@@ -0,0 +1,109 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.enforceFirestoreRulesGetAccess = void 0;
+const createRule_1 = require("../utils/createRule");
+const DIRECT_ACCESS_REGEX = /\b(?:request\.resource|resource)\.data(?!\.get\()(?:\.(?!get\()[A-Za-z_]\w*|\[['"][^'"]+['"]\])+(?:\s*)(?:!=|==|!==|===)\s*(?:null|undefined)\b/;
+function hasDirectFieldAccessComparison(text) {
+    // Match resource.data.<a>.<b>... or bracketed string segments compared to null/undefined.
+    return DIRECT_ACCESS_REGEX.test(text);
+}
+function hasGetWithoutDefault(text) {
+    // Look for `.get('field')` with a single argument. We only check in contexts that
+    // also mention resource.data/request.resource.data to reduce false positives.
+    const mentionsRulesContext = /\b(?:request\.resource|resource)\.data\b/.test(text);
+    if (!mentionsRulesContext)
+        return false;
+    const singleArgGetRegex = /\.get\(\s*(['"][^'"]+['"])\s*\)/;
+    return singleArgGetRegex.test(text);
+}
+function applyDirectAccessFixes(text) {
+    // Replace each direct access chain with equivalent `.get('seg', null)` chain
+    const pattern = /\b((?:request\.resource|resource)\.data)(?!\.get\()((?:\.(?!get\()[A-Za-z_]\w*|\[['"][^'"]+['"]\])+)(\s*)((?:!=|==|!==|===)\s*(?:null|undefined)\b)/g;
+    const segmentRegex = /(?:\.(?!get\()[A-Za-z_]\w*|\[['"][^'"]+['"]\])/g;
+    const unescapeLiteral = (raw) => raw.replace(/\\(['"\\])/g, '$1');
+    return text.replace(pattern, (_m, prefix, path, preOpWhitespace, opAndRest) => {
+        const segments = [];
+        path.replace(segmentRegex, (seg) => {
+            if (seg.startsWith('.')) {
+                segments.push(seg.slice(1));
+                return '';
+            }
+            const match = /"\s*([^"]+)"|'\s*([^']+)'/.exec(seg);
+            if (match) {
+                const raw = match[1] ?? match[2] ?? '';
+                segments.push(unescapeLiteral(raw));
+            }
+            return '';
+        });
+        const replaced = segments
+            .map((seg) => `.get('${seg.replace(/'/g, "\\'")}', null)`)
+            .join('');
+        return `${prefix}${replaced}${preOpWhitespace}${opAndRest}`;
+    });
+}
+function applyGetDefaultFixes(text) {
+    // Add ", null" as the second argument when `.get('field')` is used
+    const singleArgGetRegexGlobal = /\.get\(\s*(['"][^'"]+['"])\s*\)/g;
+    return text.replace(singleArgGetRegexGlobal, (_m, keyLiteral) => `.get(${keyLiteral}, null)`);
+}
+exports.enforceFirestoreRulesGetAccess = (0, createRule_1.createRule)({
+    name: 'enforce-firestore-rules-get-access',
+    meta: {
+        type: 'suggestion',
+        docs: {
+            description: 'Ensure Firestore security rules use .get() with a default value instead of direct field access comparisons (e.g., resource.data.fieldX.fieldY != null).',
+            recommended: 'error',
+        },
+        fixable: 'code',
+        schema: [],
+        messages: {
+            useGetAccess: "Use .get('<field>', null) instead of direct field access in Firestore rules, e.g., resource.data.get('fieldX', null).",
+            requireGetDefault: "Provide a default value to .get() in Firestore rules, e.g., .get('fieldX', null).",
+        },
+    },
+    defaultOptions: [],
+    create(context) {
+        return {
+            Literal(node) {
+                if (typeof node.value !== 'string')
+                    return;
+                const value = node.value;
+                if (!/(?:request\.resource|resource)\.data/.test(value))
+                    return;
+                const needsDirectFix = hasDirectFieldAccessComparison(value);
+                const needsGetDefaultFix = hasGetWithoutDefault(value);
+                if (!needsDirectFix && !needsGetDefaultFix)
+                    return;
+                context.report({
+                    node,
+                    messageId: needsDirectFix ? 'useGetAccess' : 'requireGetDefault',
+                    fix: (fixer) => {
+                        let newText = value;
+                        if (needsDirectFix)
+                            newText = applyDirectAccessFixes(newText);
+                        if (needsGetDefaultFix)
+                            newText = applyGetDefaultFixes(newText);
+                        return fixer.replaceText(node, `"${newText.replace(/"/g, '\\"')}"`);
+                    },
+                });
+            },
+            TemplateLiteral(node) {
+                // Best-effort: we only join static quasis and ignore embedded expressions,
+                // so template expressions spanning placeholders may be missed.
+                const staticText = node.quasis.map((q) => q.value.raw).join('');
+                if (!/(?:request\.resource|resource)\.data/.test(staticText))
+                    return;
+                const needsDirectFix = hasDirectFieldAccessComparison(staticText);
+                const needsGetDefaultFix = hasGetWithoutDefault(staticText);
+                if (!needsDirectFix && !needsGetDefaultFix)
+                    return;
+                context.report({
+                    node,
+                    messageId: needsDirectFix ? 'useGetAccess' : 'requireGetDefault',
+                    // No auto-fix for template literals due to dynamic expressions
+                });
+            },
+        };
+    },
+});
+//# sourceMappingURL=enforce-firestore-rules-get-access.js.map