@craft-ts/dev-tools 0.7.0-beta.13 → 0.7.0-beta.15

package/src/eslint-rules/prefer-direct-yieldable-callback.cjs

@@ -3,7 +3,7 @@ module.exports = {
     type: 'suggestion',
     docs: {
       description:
-        'Prefer passing a yieldable callback directly when a template generator only delegates to it.',
+        'Prefer passing a yieldable callback directly when a template generator or method only delegates to it.',
     },
     fixable: 'code',
     schema: [],
@@ -41,14 +41,20 @@ module.exports = {
         }
 
         context.report({
-          node,
+          node: getReportNode(node),
           messageId: 'preferDirect',
           fix(fixer) {
-            const delegatedCall = node.body.body[0].argument.argument;
-            return fixer.replaceText(
-              node,
-              sourceCode.getText(delegatedCall.callee),
-            );
+            const delegatedCall = getDelegatedCall(node);
+            const directCallback = sourceCode.getText(delegatedCall.callee);
+
+            if (isMethodProperty(node)) {
+              return fixer.replaceText(
+                node.parent,
+                `${sourceCode.getText(node.parent.key)}: ${directCallback}`,
+              );
+            }
+
+            return fixer.replaceText(node, directCallback);
           },
         });
       });
@@ -66,19 +72,56 @@ module.exports = {
         return false;
       }
 
-      const statement = node.body.body[0];
-      const delegatedCall = statement.argument?.argument;
+      const delegatedCall = getDelegatedCall(node);
 
       return Boolean(
-        statement.type === 'ReturnStatement' &&
-          statement.argument?.type === 'YieldExpression' &&
-          statement.argument.delegate &&
-          delegatedCall?.type === 'CallExpression' &&
+        delegatedCall?.type === 'CallExpression' &&
           delegatedCall.arguments.length === 0 &&
-          delegatedCall.callee.type === 'Identifier',
+          isDirectCallbackCallee(delegatedCall.callee),
+      );
+    }
+
+    function isDirectCallbackCallee(callee) {
+      if (callee.type === 'Identifier') {
+        return true;
+      }
+
+      return (
+        callee.type === 'MemberExpression' &&
+        !callee.computed &&
+        !callee.optional &&
+        callee.property.type === 'Identifier' &&
+        isDirectCallbackCallee(callee.object)
       );
     }
 
+    function getDelegatedCall(node) {
+      const statement = node.body.body[0];
+      const yieldExpression =
+        statement.type === 'ReturnStatement'
+          ? statement.argument
+          : statement.type === 'ExpressionStatement'
+            ? statement.expression
+            : undefined;
+
+      return yieldExpression?.type === 'YieldExpression' &&
+        yieldExpression.delegate
+        ? yieldExpression.argument
+        : undefined;
+    }
+
+    function isMethodProperty(node) {
+      return (
+        node.parent?.type === 'Property' &&
+        node.parent.value === node &&
+        node.parent.method
+      );
+    }
+
+    function getReportNode(node) {
+      return isMethodProperty(node) ? node.parent : node;
+    }
+
     function isNestedCraftComponent(node) {
       return (
         node.type === 'CallExpression' &&

package/src/eslint-rules/prefer-inline-effect-insertion.cjs

@@ -0,0 +1,263 @@
+'use strict';
+
+const EFFECT_PACKAGE = '@craft-ts/effect';
+
+module.exports = {
+  meta: {
+    type: 'suggestion',
+    docs: {
+      description:
+        'Keep queryEffect insertion callbacks inline so their types are inferred.',
+    },
+    fixable: 'code',
+    schema: [],
+    messages: {
+      inline:
+        'Keep the queryEffect insertion callback inline and let its types be inferred; do not extract a typed helper.',
+    },
+  },
+
+  create(context) {
+    const sourceCode = context.sourceCode ?? context.getSourceCode();
+    const queryEffectBindings = new Set();
+    const visitorKeys = sourceCode.visitorKeys ?? {};
+
+    return {
+      ImportDeclaration(node) {
+        if (node.source.value !== EFFECT_PACKAGE) return;
+        for (const specifier of node.specifiers) {
+          if (
+            specifier.type === 'ImportSpecifier' &&
+            getIdentifierName(specifier.imported) === 'queryEffect'
+          ) {
+            queryEffectBindings.add(specifier.local.name);
+          }
+        }
+      },
+
+      'Program:exit'(program) {
+        walk(program, (node) => {
+          if (
+            node.type !== 'CallExpression' ||
+            node.callee.type !== 'Identifier' ||
+            !queryEffectBindings.has(node.callee.name)
+          ) {
+            return;
+          }
+
+          const insertion = node.arguments[2];
+          if (!insertion || insertion.type !== 'Identifier') return;
+
+          const helper = findInsertionHelper(program, insertion.name);
+          if (!helper) return;
+
+          const callback = helper.init;
+          const callbackText = withoutParameterType(callback, sourceCode);
+          const fixes = [
+            fixerReplace(sourceCode, insertion, callbackText),
+            removeDeclaration(helper),
+          ];
+
+          const typeName = getParameterTypeName(callback);
+          const typeAlias = typeName && findTypeAlias(program, typeName);
+          if (
+            typeAlias &&
+            !hasOtherReference(program, typeName, [
+              typeAlias,
+              callback.params[0]?.typeAnnotation,
+            ])
+          ) {
+            fixes.push(removeDeclaration(typeAlias));
+
+            const insertionParamsImport = findImportSpecifier(
+              program,
+              'InsertionParams',
+            );
+            if (
+              insertionParamsImport &&
+              !hasOtherReference(program, 'InsertionParams', [
+                typeAlias,
+                insertionParamsImport,
+              ])
+            ) {
+              fixes.push(removeImportSpecifier(insertionParamsImport));
+            }
+          }
+
+          context.report({
+            node: insertion,
+            messageId: 'inline',
+            fix(fixer) {
+              return fixes.map((fix) => fix(fixer));
+            },
+          });
+        }, visitorKeys);
+      },
+    };
+
+    function fixerReplace(_sourceCode, node, text) {
+      return (fixer) => fixer.replaceText(node, text);
+    }
+
+    function removeDeclaration(node) {
+      return (fixer) => {
+        const declaration = node.parent;
+        if (declaration.type === 'TSTypeAliasDeclaration') {
+          const container = declaration.parent;
+          return container.type === 'ExportNamedDeclaration'
+            ? fixer.remove(container)
+            : fixer.remove(declaration);
+        }
+
+        if (declaration.type !== 'VariableDeclaration') {
+          return fixer.remove(node);
+        }
+
+        const statement =
+          declaration.parent.type === 'ExportNamedDeclaration'
+            ? declaration.parent
+            : declaration;
+        if (
+          declaration.declarations.length === 1
+        ) {
+          return fixer.remove(statement);
+        }
+
+        const index = declaration.declarations.indexOf(node);
+        const next = declaration.declarations[index + 1];
+        const previous = declaration.declarations[index - 1];
+        return next
+          ? fixer.removeRange([node.range[0], next.range[0]])
+          : fixer.removeRange([previous.range[1], node.range[1]]);
+      };
+    }
+
+    function removeImportSpecifier(specifier) {
+      return (fixer) => {
+        const declaration = specifier.parent;
+        if (declaration.specifiers.length === 1) {
+          return fixer.remove(declaration);
+        }
+
+        const index = declaration.specifiers.indexOf(specifier);
+        const next = declaration.specifiers[index + 1];
+        const previous = declaration.specifiers[index - 1];
+        return next
+          ? fixer.removeRange([specifier.range[0], next.range[0]])
+          : fixer.removeRange([previous.range[1], specifier.range[1]]);
+      };
+    }
+
+    function findInsertionHelper(program, name) {
+      let result;
+      walk(program, (node) => {
+        if (
+          result ||
+          node.type !== 'VariableDeclarator' ||
+          node.id.type !== 'Identifier' ||
+          node.id.name !== name ||
+          !isFunction(node.init)
+        ) {
+          return;
+        }
+        result = node;
+      }, visitorKeys);
+      return result;
+    }
+
+    function findTypeAlias(program, name) {
+      let result;
+      walk(program, (node) => {
+        if (
+          !result &&
+          node.type === 'TSTypeAliasDeclaration' &&
+          node.id.name === name
+        ) {
+          result = node;
+        }
+      }, visitorKeys);
+      return result;
+    }
+
+    function findImportSpecifier(program, name) {
+      let result;
+      walk(program, (node) => {
+        if (
+          !result &&
+          node.type === 'ImportSpecifier' &&
+          getIdentifierName(node.imported) === name
+        ) {
+          result = node;
+        }
+      }, visitorKeys);
+      return result;
+    }
+
+    function hasOtherReference(program, name, excluded) {
+      let found = false;
+      walk(program, (node) => {
+        if (
+          !found &&
+          node.type === 'Identifier' &&
+          node.name === name &&
+          !excluded.some((parent) => parent && isDescendant(node, parent))
+        ) {
+          found = true;
+        }
+      }, visitorKeys);
+      return found;
+    }
+
+    function isDescendant(node, ancestor) {
+      let current = node;
+      while (current) {
+        if (current === ancestor) return true;
+        current = current.parent;
+      }
+      return false;
+    }
+  },
+};
+
+function getParameterTypeName(callback) {
+  const annotation = callback.params[0]?.typeAnnotation;
+  const typeName = annotation?.typeAnnotation;
+  return typeName?.type === 'TSTypeReference' &&
+    typeName.typeName.type === 'Identifier'
+    ? typeName.typeName.name
+    : undefined;
+}
+
+function withoutParameterType(callback, sourceCode) {
+  const text = sourceCode.getText(callback);
+  const annotation = callback.params[0]?.typeAnnotation;
+  if (!annotation) return text;
+
+  const start = annotation.range[0] - callback.range[0];
+  const end = annotation.range[1] - callback.range[0];
+  return text.slice(0, start) + text.slice(end);
+}
+
+function isFunction(node) {
+  return (
+    node?.type === 'ArrowFunctionExpression' ||
+    node?.type === 'FunctionExpression'
+  );
+}
+
+function getIdentifierName(node) {
+  return node.type === 'Identifier' ? node.name : undefined;
+}
+
+function walk(node, visit, visitorKeys) {
+  if (!node || typeof node.type !== 'string') return;
+  visit(node);
+  for (const key of visitorKeys[node.type] ?? []) {
+    const child = node[key];
+    if (Array.isArray(child)) {
+      child.forEach((item) => walk(item, visit, visitorKeys));
+    } else {
+      walk(child, visit, visitorKeys);
+    }
+  }
+}

package/src/eslint-rules/prefer-inline-route-providers.cjs

@@ -0,0 +1,138 @@
+'use strict';
+
+const COMPONENT_PACKAGE = '@craft-ts/component';
+
+module.exports = {
+  meta: {
+    type: 'suggestion',
+    docs: {
+      description:
+        'Prefer inlining route providers that are used only once by loadCraftComponent.',
+    },
+    fixable: 'code',
+    schema: [],
+    messages: {
+      inline:
+        'Inline this route provider tuple in loadCraftComponent(...); it is only used once.',
+    },
+  },
+
+  create(context) {
+    const sourceCode = context.sourceCode ?? context.getSourceCode();
+    const loadCraftComponentBindings = new Set();
+    const visitorKeys = sourceCode.visitorKeys ?? {};
+
+    return {
+      ImportDeclaration(node) {
+        if (node.source.value !== COMPONENT_PACKAGE) return;
+        for (const specifier of node.specifiers) {
+          if (
+            specifier.type === 'ImportSpecifier' &&
+            getIdentifierName(specifier.imported) === 'loadCraftComponent'
+          ) {
+            loadCraftComponentBindings.add(specifier.local.name);
+          }
+        }
+      },
+
+      'Program:exit'(program) {
+        walk(program, (node) => {
+          if (node.type !== 'VariableDeclarator') return;
+          if (
+            node.id.type !== 'Identifier' ||
+            !isProviderArray(node.init)
+          ) {
+            return;
+          }
+
+          const references = findReferences(program, node.id.name, node);
+          if (references.length !== 1) return;
+
+          const reference = references[0];
+          const call = reference.parent;
+          if (
+            call?.type !== 'CallExpression' ||
+            call.arguments[1] !== reference ||
+            call.callee.type !== 'Identifier' ||
+            !loadCraftComponentBindings.has(call.callee.name)
+          ) {
+            return;
+          }
+
+          context.report({
+            node: reference,
+            messageId: 'inline',
+            fix(fixer) {
+              return [
+                fixer.replaceText(reference, sourceCode.getText(node.init)),
+                removeDeclaration(fixer, node),
+              ];
+            },
+          });
+        }, visitorKeys);
+      },
+    };
+
+    function findReferences(program, name, declaration) {
+      const references = [];
+      walk(program, (node) => {
+        if (
+          node.type === 'Identifier' &&
+          node.name === name &&
+          node !== declaration.id
+        ) {
+          references.push(node);
+        }
+      }, visitorKeys);
+      return references;
+    }
+  },
+};
+
+function isProviderArray(node) {
+  let current = node;
+  while (
+    current &&
+    ['TSAsExpression', 'TSSatisfiesExpression', 'TSNonNullExpression'].includes(
+      current.type,
+    )
+  ) {
+    current = current.expression;
+  }
+  return current?.type === 'ArrayExpression';
+}
+
+function removeDeclaration(fixer, node) {
+  const declaration = node.parent;
+  if (declaration.type !== 'VariableDeclaration') {
+    return fixer.remove(node);
+  }
+
+  if (declaration.declarations.length === 1) {
+    return fixer.remove(declaration);
+  }
+
+  const index = declaration.declarations.indexOf(node);
+  const next = declaration.declarations[index + 1];
+  const previous = declaration.declarations[index - 1];
+  return next
+    ? fixer.removeRange([node.range[0], next.range[0]])
+    : fixer.removeRange([previous.range[1], node.range[1]]);
+}
+
+function getIdentifierName(node) {
+  return node.type === 'Identifier' ? node.name : undefined;
+}
+
+function walk(node, visit, visitorKeys) {
+  if (!node || typeof node.type !== 'string') return;
+  visit(node);
+  for (const key of visitorKeys[node.type] ?? []) {
+    const child = node[key];
+    if (Array.isArray(child)) {
+      child.forEach((item) => walk(item, visit, visitorKeys));
+    } else {
+      walk(child, visit, visitorKeys);
+    }
+  }
+}

package/src/eslint-rules/recommended-config.cjs

@@ -18,6 +18,11 @@ module.exports = {
   'craft-ts/no-craft-computed-side-effects': 'error',
   'craft-ts/provide-host-name-match-component': 'warn',
   'craft-ts/prefer-craft-http-transport': 'error',
+  'craft-ts/no-craft-service-component-same-file': 'warn',
+  'craft-ts/no-raw-css-value': 'error',
+  'craft-ts/no-raw-class': 'error',
+  'craft-ts/no-free-has': 'error',
+  'craft-ts/style-file-boundary': 'error',
   'craft-ts/no-imperative-craft-resource-trigger': 'error',
   'craft-ts/no-transition-actions': 'error',
   'craft-ts/require-craft-resource-trigger-yield': 'error',
@@ -43,6 +48,7 @@ module.exports = {
   'craft-ts/no-injection-token': 'error',
   'craft-ts/no-manual-route-provider-list': 'error',
   'craft-ts/no-widened-route-provider-context': 'error',
+  'craft-ts/prefer-inline-route-providers': 'error',
   'craft-ts/no-async-await': 'error',
   'craft-ts/no-throw': 'error',
   'craft-ts/require-assert-exhaustive-route-exceptions': 'warn',

package/src/eslint-rules/require-reactive-template-bindings.cjs

@@ -1,15 +1,15 @@
 const REACTIVE_BRANDS = ['SIGNAL', 'YIELDABLE_VALUE', 'INPUT_BRAND'];
 const { NAMED_HTML_HELPERS } = require('./html-helpers.cjs');
 const STRUCTURAL_HELPERS = new Set([
-  'catchBlock',
+  'catchNode',
   'content',
-  'defer',
-  'each',
+  'deferNode',
+  'forNode',
   'heading',
   'headingSection',
-  'ifBlock',
+  'ifNode',
   'liveRegion',
-  'matchBlock',
+  'matchNode',
   'renderContent',
   'renderTemplate',
 ]);
@@ -170,13 +170,13 @@ module.exports = {
       const argumentIndex = argument ? call.arguments.indexOf(argument) : -1;
       const key = enclosingPropertyName(fn, call);
 
-      if (name === 'each') {
+      if (name === 'forNode') {
         return argumentIndex === 2 || key === 'empty';
       }
-      if (name === 'ifBlock') {
+      if (name === 'ifNode') {
         return argumentIndex === 1 || argumentIndex === 2;
       }
-      if (name === 'defer') {
+      if (name === 'deferNode') {
         return ['resolve', 'placeholder', 'loading', 'error'].includes(key);
       }
       if (name === 'exhaustive') {

package/src/eslint-rules/require-route-security-policy.cjs

@@ -0,0 +1,87 @@
+const { report, isCallNamed } = require('./security-rule-utils.cjs');
+
+function nameOf(property) {
+  return String(property.key.name ?? property.key.value ?? '');
+}
+
+/** `component:`, `loadComponent:` ou le spread `...loadCraftComponent(...)`. */
+function rendersComponent(route) {
+  return route.properties.some((property) => {
+    if (property.type === 'Property') {
+      const name = nameOf(property);
+      return name === 'component' || name === 'loadComponent';
+    }
+    if (property.type === 'SpreadElement') {
+      return isCallNamed(property.argument, 'loadCraftComponent');
+    }
+    return false;
+  });
+}
+
+function declaresPolicy(route) {
+  return route.properties.some(
+    (property) =>
+      property.type === 'Property' &&
+      (nameOf(property) === 'ssr' || nameOf(property) === 'security'),
+  );
+}
+
+module.exports = {
+  meta: {
+    type: 'problem',
+    schema: [
+      {
+        type: 'object',
+        properties: {
+          /**
+           * `auto` (défaut) : n'exige la déclaration que dans un fichier qui
+           * en contient déjà une, c'est-à-dire une application qui rend côté
+           * serveur. Une route oubliée y est un vrai trou ; une SPA qui ne
+           * déclare rien nulle part n'a rien à déclarer.
+           * `required` : exige la politique sur toute route rendue.
+           * `off` : désactive la vérification.
+           */
+          mode: { enum: ['auto', 'required', 'off'] },
+        },
+        additionalProperties: false,
+      },
+    ],
+    docs: {
+      description: 'Require an explicit SSR policy on every rendered route.',
+    },
+  },
+  create(context) {
+    const mode = (context.options[0] && context.options[0].mode) || 'auto';
+    if (mode === 'off') return {};
+    return {
+      CallExpression(node) {
+        if (!isCallNamed(node, 'craftRoutes')) return;
+        const list = node.arguments.find(
+          (argument) => argument.type === 'ArrayExpression',
+        );
+        if (!list) return;
+        const routes = list.elements.filter(
+          (element) => element && element.type === 'ObjectExpression',
+        );
+        const rendered = routes.filter(rendersComponent);
+        if (mode === 'auto' && !rendered.some(declaresPolicy)) return;
+        for (const route of rendered) {
+          if (declaresPolicy(route)) continue;
+          const path = route.properties.find(
+            (property) =>
+              property.type === 'Property' && nameOf(property) === 'path',
+          );
+          const label =
+            path && path.value.type === 'Literal'
+              ? `"${path.value.value}"`
+              : 'a route';
+          report(
+            context,
+            route,
+            `Route ${label} must declare an explicit ssr policy (mode: 'block' | 'skip' | 'stream').`,
+          );
+        }
+      },
+    };
+  },
+};

package/src/eslint-rules/require-server-function-timeout.cjs

@@ -0,0 +1,39 @@
+const { report, isCallNamed } = require('./security-rule-utils.cjs');
+
+function propertyOf(node, name) {
+  if (!node || node.type !== 'ObjectExpression') return undefined;
+  return node.properties.find(
+    (property) =>
+      property.type === 'Property' &&
+      (property.key.name ?? property.key.value) === name,
+  );
+}
+
+module.exports = {
+  meta: {
+    type: 'problem',
+    schema: [],
+    docs: { description: 'Require body and timeout limits for server functions.' },
+  },
+  create(context) {
+    return {
+      CallExpression(node) {
+        if (!isCallNamed(node, 'createServer')) return;
+        const options = node.arguments[0];
+        if (!options || options.type !== 'ObjectExpression') return;
+        // `createServer` de node:http prend un callback : ne rien dire.
+        if (!propertyOf(options, 'functions')) return;
+        const runtime = propertyOf(options, 'runtimeOptions');
+        const value = runtime && runtime.value;
+        const has = (name) => Boolean(propertyOf(value, name));
+        if (!has('timeoutMs') || !has('maxBodyBytes')) {
+          report(
+            context,
+            node,
+            'createServer requires runtimeOptions.timeoutMs and runtimeOptions.maxBodyBytes.',
+          );
+        }
+      },
+    };
+  },
+};

package/src/eslint-rules/security-config.cjs

@@ -0,0 +1,14 @@
+/**
+ * Préréglage sécurité, inclus dans `recommended` et dans `effect` : ces
+ * garde-fous portent sur des vecteurs d'attaque, pas sur du style, donc ils
+ * s'appliquent par défaut plutôt que sur adhésion.
+ */
+module.exports = {
+  'craft-ts/require-route-security-policy': 'error',
+  'craft-ts/require-server-function-timeout': 'error',
+  'craft-ts/no-auth-token-in-local-storage': 'error',
+  'craft-ts/no-raw-user-url': 'error',
+  'craft-ts/no-unsafe-transfer-state': 'error',
+  'craft-ts/no-unsafe-html': 'error',
+  'craft-ts/no-trust-forwarded-headers': 'error',
+};