@ddd-ts-kit/eslint-plugin 0.0.0-stage → 0.1.1

package/dist/rules/aspects-outside-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aspects-outside-in.js","sourceRoot":"","sources":["../../src/rules/aspects-outside-in.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,gDAAgD,CAAC;AAEjF,MAAM,UAAU,GAAG,GAAG,eAAe,aAAa,CAAC;AAEnD,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAe;IACvD,EAAE,EAAE,oBAAoB;IACxB,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,OAAO;IACpB,WAAW,EACT,qKAAqK;IACvK,QAAQ,EAAE;QACR,UAAU,EAAE,IAAI,UAAU,4QAA4Q;KACvS;IACD,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE;QACrB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,cAAc,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE;YAClD,IAAI,SAAS,KAAK,UAAU,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC;gBACvE,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC;AAEH,6HAA6H;AAC7H,SAAS,QAAQ,CAAC,IAAgB;IAChC,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAE1B,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,gBAAgB,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC9G,CAAC;AAED,SAAS,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAc;IAC7C,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACtC,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,uBAAuB,QAAQ,CAAC,OAAO,GAAG,CAAC;IACpD,CAAC;IAED,OAAO,QAAQ,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,GAAG,CAAC;AACjE,CAAC"}

package/dist/rules/authz-actor-explicit.d.ts

@@ -0,0 +1,5 @@
+import { TSESLint } from '@typescript-eslint/utils';
+type MessageId = 'imported' | 'used' | 'helper' | 'injected' | 'read';
+export declare const authzActorExplicit: TSESLint.RuleModule<MessageId, [], import("../index.js").RuleDocs, TSESLint.RuleListener>;
+export {};
+//# sourceMappingURL=authz-actor-explicit.d.ts.map

package/dist/rules/authz-actor-explicit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-actor-explicit.d.ts","sourceRoot":"","sources":["../../src/rules/authz-actor-explicit.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,QAAQ,EAAiB,MAAM,0BAA0B,CAAC;AAS7F,KAAK,SAAS,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC;AAuBtE,eAAO,MAAM,kBAAkB,2FA4C7B,CAAC"}

package/dist/rules/authz-actor-explicit.js

@@ -0,0 +1,106 @@
+import { ASTUtils, AST_NODE_TYPES, TSESLint } from '@typescript-eslint/utils';
+import { accessedName } from '../support/calls/accessed-name.js';
+import { declaredTypeName } from '../support/types/declared-type-name.js';
+import { defineRule } from '../support/rule/define-rule.js';
+import { propertyName } from '../support/globals/property-name.js';
+import { importListener } from '../support/imports/import-listener.js';
+import { innerLayer } from '../support/imports/inner-layer.js';
+import { parameterTypeName } from '../support/types/parameter-type-name.js';
+/** The two ports that answer "who, in which unit of work" without being handed it. */
+const AMBIENT_PORTS = new Set(['ActorContext', 'ExecutionScope']);
+/** The ports, their adapters of the kernel and what those are built on: a class is a type and an injection token at once, so naming one is reading the ambient context. */
+const AMBIENT = new Set([
+    ...AMBIENT_PORTS,
+    'AsyncLocalStorageExecutionScope',
+    'ScopedActorContext',
+    'AsyncLocalStorage',
+]);
+/** Kernel helpers that read the execution scope for a repository adapter: audit columns and the tenant of a statement. */
+const INFRASTRUCTURE_HELPERS = new Set(['tenantScopeOf', 'stampCreation', 'stampUpdate']);
+const READS = new Set(['current', 'require']);
+/** What an ambient context is called when its declaration is not in the file. */
+const AMBIENT_RECEIVER = /^#?(?:actors|scopes?)$|actorContext$|executionScope$/i;
+const INSTEAD = 'Read the actor from the command or query (`command.actor`, a message extending AuthorizedCommand or AuthorizedQuery) and pass what the model needs as a value; audit columns, tenant scoping and correlation are read from the execution scope by infrastructure and the platform only.';
+export const authzActorExplicit = defineRule({
+    id: 'authz/actor-explicit',
+    type: 'problem',
+    recommended: 'error',
+    description: 'Use cases receive the actor in the command or query: domain/ and application/ never read the ambient ExecutionScope or ActorContext.',
+    messages: {
+        imported: `{{name}} is imported in the {{layer}} layer, as a type or as the port named in a dependency list: it gives the actor or the execution context of the current unit of work without anybody passing it. ${INSTEAD}`,
+        used: `{{name}} is used in the {{layer}} layer: it gives the actor or the execution context of the current unit of work without anybody passing it. ${INSTEAD}`,
+        helper: `{{name}} is used in the {{layer}} layer: it reads the execution scope to stamp audit columns or to scope a statement by tenant, which is the work of a repository adapter. ${INSTEAD}`,
+        injected: `{{className}} is given {{port}}: a use case whose actor is ambient cannot be called from an integration event handler, a job or a test without setting a global. ${INSTEAD}`,
+        read: `{{read}}() reads the ambient context in the {{layer}} layer. ${INSTEAD}`,
+    },
+    create({ file, sourceCode, report }) {
+        const layer = innerLayer(file);
+        if (layer === undefined) {
+            return {};
+        }
+        const named = (node, name) => {
+            if (name !== undefined && AMBIENT.has(name)) {
+                report({ node, messageId: 'used', data: { name, layer } });
+            }
+        };
+        return {
+            ...importListener(file, ({ names }) => importedNames(names, layer, report)),
+            MemberExpression(node) {
+                named(node.property, propertyName(node));
+                if (isHelperOfNamespace(sourceCode, node)) {
+                    report({ node: node.property, messageId: 'helper', data: { name: propertyName(node), layer } });
+                }
+            },
+            TSQualifiedName: (node) => named(node.right, node.right.name),
+            MethodDefinition: (node) => injectedPorts(node, report),
+            CallExpression(node) {
+                if (isAmbientRead(sourceCode, node)) {
+                    report({ node, messageId: 'read', data: { read: sourceCode.getText(node.callee), layer } });
+                }
+            },
+        };
+    },
+});
+function importedNames(names, layer, report) {
+    for (const { name, node } of names.filter((imported) => AMBIENT.has(imported.name))) {
+        report({ node, messageId: 'imported', data: { name, layer } });
+    }
+    for (const { name, node } of names.filter((imported) => INFRASTRUCTURE_HELPERS.has(imported.name))) {
+        report({ node, messageId: 'helper', data: { name, layer } });
+    }
+}
+function injectedPorts(node, report) {
+    if (node.kind !== 'constructor') {
+        return;
+    }
+    const className = node.parent.parent.id?.name ?? 'The class';
+    for (const parameter of node.value.params) {
+        const port = parameterTypeName(parameter);
+        if (port !== undefined && AMBIENT_PORTS.has(port)) {
+            report({ node: parameter, messageId: 'injected', data: { className, port } });
+        }
+    }
+}
+/** `kernel.stampCreation` where `kernel` is an import: a method of the project that happens to carry the name is not the helper. */
+function isHelperOfNamespace(sourceCode, node) {
+    if (node.object.type !== AST_NODE_TYPES.Identifier || !INFRASTRUCTURE_HELPERS.has(propertyName(node) ?? '')) {
+        return false;
+    }
+    const definitions = ASTUtils.findVariable(sourceCode.getScope(node), node.object.name)?.defs ?? [];
+    return definitions.some((definition) => definition.type === TSESLint.Scope.DefinitionType.ImportBinding);
+}
+/**
+ * `.current()` or `.require()` without argument on an ambient context. The declared type of the
+ * receiver decides when the file shows it; otherwise its name does.
+ */
+function isAmbientRead(sourceCode, node) {
+    const { callee } = node;
+    if (callee.type !== AST_NODE_TYPES.MemberExpression ||
+        node.arguments.length > 0 ||
+        !READS.has(propertyName(callee) ?? '')) {
+        return false;
+    }
+    const declared = declaredTypeName(sourceCode, callee.object);
+    return declared === undefined ? AMBIENT_RECEIVER.test(accessedName(callee.object) ?? '') : AMBIENT.has(declared);
+}
+//# sourceMappingURL=authz-actor-explicit.js.map

package/dist/rules/authz-actor-explicit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-actor-explicit.js","sourceRoot":"","sources":["../../src/rules/authz-actor-explicit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAiB,MAAM,0BAA0B,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAe,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAqB,MAAM,uCAAuC,CAAC;AAC1F,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAK5E,sFAAsF;AACtF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAElE,2KAA2K;AAC3K,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;IACtB,GAAG,aAAa;IAChB,iCAAiC;IACjC,oBAAoB;IACpB,mBAAmB;CACpB,CAAC,CAAC;AAEH,0HAA0H;AAC1H,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC;AAC1F,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;AAC9C,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,uDAAuD,CAAC;AAEjF,MAAM,OAAO,GACX,yRAAyR,CAAC;AAE5R,MAAM,CAAC,MAAM,kBAAkB,GAAG,UAAU,CAAY;IACtD,EAAE,EAAE,sBAAsB;IAC1B,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,OAAO;IACpB,WAAW,EACT,sIAAsI;IACxI,QAAQ,EAAE;QACR,QAAQ,EAAE,yMAAyM,OAAO,EAAE;QAC5N,IAAI,EAAE,gJAAgJ,OAAO,EAAE;QAC/J,MAAM,EAAE,8KAA8K,OAAO,EAAE;QAC/L,QAAQ,EAAE,oKAAoK,OAAO,EAAE;QACvL,IAAI,EAAE,gEAAgE,OAAO,EAAE;KAChF;IACD,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE;QACjC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAE/B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,KAAK,GAAG,CAAC,IAAmB,EAAE,IAAwB,EAAQ,EAAE;YACpE,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5C,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC,CAAC;QAEF,OAAO;YACL,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC3E,gBAAgB,CAAC,IAAI;gBACnB,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;gBAEzC,IAAI,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC;oBAC1C,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;gBAClG,CAAC;YACH,CAAC;YACD,eAAe,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAC7D,gBAAgB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC;YACvD,cAAc,CAAC,IAAI;gBACjB,IAAI,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC;oBACpC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC9F,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,SAAS,aAAa,CAAC,KAA8B,EAAE,KAAa,EAAE,MAAyB;IAC7F,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACpF,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACnG,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAA+B,EAAE,MAAyB;IAC/E,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAChC,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,IAAI,WAAW,CAAC;IAE7D,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAE1C,IAAI,IAAI,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;AACH,CAAC;AAED,oIAAoI;AACpI,SAAS,mBAAmB,CAAC,UAAkB,EAAE,IAA+B;IAC9E,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,cAAc,CAAC,UAAU,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC5G,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAAG,QAAQ,CAAC,YAAY,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;IAEnG,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;AAC3G,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,UAAkB,EAAE,IAA6B;IACtE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAExB,IACE,MAAM,CAAC,IAAI,KAAK,cAAc,CAAC,gBAAgB;QAC/C,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QACzB,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EACtC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAE7D,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACnH,CAAC"}

package/dist/rules/authz-declared.d.ts

@@ -0,0 +1,5 @@
+import { type TSESLint } from '@typescript-eslint/utils';
+type MessageId = 'useCase' | 'message' | 'route' | 'emptySecurity' | 'actor';
+export declare const authzDeclared: TSESLint.RuleModule<MessageId, [], import("../index.js").RuleDocs, TSESLint.RuleListener>;
+export {};
+//# sourceMappingURL=authz-declared.d.ts.map

package/dist/rules/authz-declared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-declared.d.ts","sourceRoot":"","sources":["../../src/rules/authz-declared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,QAAQ,EAAiB,MAAM,0BAA0B,CAAC;AAmBxF,KAAK,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,eAAe,GAAG,OAAO,CAAC;AAQ7E,eAAO,MAAM,aAAa,2FA8CxB,CAAC"}

package/dist/rules/authz-declared.js

@@ -0,0 +1,167 @@
+import { AST_NODE_TYPES } from '@typescript-eslint/utils';
+import { calleeName } from '../support/calls/callee-name.js';
+import { hasSpread } from '../support/calls/has-spread.js';
+import { methodChain } from '../support/calls/method-chain.js';
+import { propertyOf } from '../support/calls/property-of.js';
+import { className } from '../support/classes/class-name.js';
+import { constructorOf } from '../support/classes/constructor-of.js';
+import { exportedClasses } from '../support/classes/exported-classes.js';
+import { ACCESS_DECORATORS } from '../support/declarations/access-decorators.js';
+import { DECLARATIONS_ENTRY, declarationReader } from '../support/declarations/declaration-reader.js';
+import { declaredRoleOf } from '../support/declarations/declared-role-of.js';
+import { isDeclaredStyle } from '../support/declarations/is-declared-style.js';
+import { defineRule } from '../support/rule/define-rule.js';
+import { inLayer } from '../support/imports/in-layer.js';
+import { staticString } from '../support/imports/static-string.js';
+import { classFinder } from '../support/classes/class-finder.js';
+import { parameterBinding } from '../support/types/parameter-binding.js';
+const REGISTRATIONS = new Set(['command', 'query']);
+const HANDLER_BINDINGS = new Set(['handledBy', 'handledByFactory']);
+const DECLARATIONS = new Set(['requires', 'public']);
+const AUTHORIZED_BASES = new Set(['AuthorizedCommand', 'AuthorizedQuery']);
+export const authzDeclared = defineRule({
+    id: 'authz/declared',
+    type: 'problem',
+    recommended: 'error',
+    description: 'Every command, query and route declares the permission it requires, or declares itself public, in its module registration or on the message class: nothing is reachable by default.',
+    messages: {
+        useCase: 'The {{kind}} {{name}} is registered without saying who may send it. Insert `.requires(<a permission of application/authorization>)` before `.{{binding}}(...)`, or `.public()` if anybody may: nothing is reachable by default.',
+        message: `The {{kind}} {{className}} says nothing about who may send it. Put \`@Requires(<a permission of application/authorization>)\` from "${DECLARATIONS_ENTRY}" on the class, or \`@Public()\` if anybody may: nothing is reachable by default.`,
+        route: "The route {{route}} declares no `security`. Add `security: ['<scheme>']` with the security schemes that apply, or `security: false` if the route is public.",
+        emptySecurity: 'The route {{route}} declares `security: []`: no scheme applies, so it is public by accident. Name the schemes that apply, or write `security: false`.',
+        actor: '{{className}} extends {{base}} but does not hand the actor it is given to `super(...)`. Take the actor as the first constructor parameter and pass it on, `constructor(actor: Actor, ...) { super(actor); }`: the caller says who acts, the message never decides it.',
+    },
+    create({ file, sourceCode, context, report }) {
+        if (file.isTest) {
+            return {};
+        }
+        const isModule = inLayer(file, 'module') !== undefined;
+        const findClass = classFinder(file, sourceCode.ast, context.languageOptions.parser);
+        const tell = (finding) => {
+            if (finding !== undefined) {
+                report(finding);
+            }
+        };
+        const judgeClass = (node) => tell(unforwardedActor(node));
+        return {
+            Program: (program) => undeclaredMessages(file, program).forEach(tell),
+            CallExpression(node) {
+                if (isModule) {
+                    tell(undeclaredUseCase(node, sourceCode, findClass));
+                }
+                tell(undeclaredRoute(node));
+            },
+            ClassDeclaration: judgeClass,
+            ClassExpression: judgeClass,
+        };
+    },
+});
+/** In the declared style the message class itself says who may send it: there is no registration to read. */
+function undeclaredMessages(file, program) {
+    const role = isDeclaredStyle(file) ? declaredRoleOf(file) : undefined;
+    if (role?.decorators.some((decorator) => ACCESS_DECORATORS.has(decorator)) !== true) {
+        return [];
+    }
+    const declarationsOf = declarationReader(program);
+    const silent = exportedClasses(program).filter((node) => !declarationsOf(node).some((declaration) => ACCESS_DECORATORS.has(declaration.name)));
+    return silent.map((node) => ({
+        node: node.id ?? node,
+        messageId: 'message',
+        data: { kind: role.suffix, className: className(node) },
+    }));
+}
+function undeclaredUseCase(node, sourceCode, findClass) {
+    const binding = node.callee.type === AST_NODE_TYPES.MemberExpression ? (calleeName(node) ?? '') : '';
+    if (!HANDLER_BINDINGS.has(binding)) {
+        return undefined;
+    }
+    const chain = methodChain(node);
+    const [registration] = chain;
+    if (registration === undefined ||
+        !REGISTRATIONS.has(registration.name) ||
+        chain.some((link) => DECLARATIONS.has(link.name))) {
+        return undefined;
+    }
+    const [message] = registration.call.arguments;
+    if (isDeclaredMessage(message, findClass)) {
+        return undefined;
+    }
+    const name = message === undefined ? 'registered here' : sourceCode.getText(message);
+    return { node: registration.call, messageId: 'useCase', data: { kind: registration.name, name, binding } };
+}
+/** `@Requires(...)` or `@Public()` on the message class is the declaration, whoever registers the message. */
+function isDeclaredMessage(message, findClass) {
+    const site = message?.type === AST_NODE_TYPES.Identifier ? findClass(message.name) : undefined;
+    return (site !== undefined &&
+        declarationReader(site.program)(site.node).some((declaration) => ACCESS_DECORATORS.has(declaration.name)));
+}
+function undeclaredRoute(node) {
+    const [spec] = node.arguments;
+    if (calleeName(node) !== 'defineRoute' || spec?.type !== AST_NODE_TYPES.ObjectExpression) {
+        return undefined;
+    }
+    const messageId = judgeSecurity(spec);
+    return messageId === undefined
+        ? undefined
+        : { node: propertyOf(spec, 'security') ?? spec, messageId, data: { route: routeLabel(spec) } };
+}
+function judgeSecurity(spec) {
+    const security = propertyOf(spec, 'security');
+    if (security === undefined) {
+        return hasSpread(spec) ? undefined : 'route';
+    }
+    const { value } = security;
+    if (value.type === AST_NODE_TYPES.ArrayExpression) {
+        return value.elements.length === 0 ? 'emptySecurity' : undefined;
+    }
+    return value.type === AST_NODE_TYPES.Identifier && value.name === 'undefined' ? 'route' : undefined;
+}
+function routeLabel(spec) {
+    const named = propertyOf(spec, 'operationId') ?? propertyOf(spec, 'path');
+    const label = named === undefined ? undefined : staticString(named.value);
+    return label === undefined ? 'defined here' : `"${label}"`;
+}
+function unforwardedActor(node) {
+    const base = node.superClass === null ? undefined : baseName(node.superClass);
+    const constructor = constructorOf(node.body);
+    if (base === undefined || !AUTHORIZED_BASES.has(base) || constructor === undefined) {
+        return undefined;
+    }
+    const call = superCall(constructor);
+    if (call === undefined || forwardsParameter(call, constructor)) {
+        return undefined;
+    }
+    return { node: call, messageId: 'actor', data: { className: className(node), base } };
+}
+function baseName(superClass) {
+    if (superClass.type === AST_NODE_TYPES.Identifier) {
+        return superClass.name;
+    }
+    return superClass.type === AST_NODE_TYPES.MemberExpression && superClass.property.type === AST_NODE_TYPES.Identifier
+        ? superClass.property.name
+        : undefined;
+}
+function superCall(constructor) {
+    for (const statement of constructor.value.body?.body ?? []) {
+        const expression = statement.type === AST_NODE_TYPES.ExpressionStatement ? statement.expression : undefined;
+        if (expression?.type === AST_NODE_TYPES.CallExpression && expression.callee.type === AST_NODE_TYPES.Super) {
+            return expression;
+        }
+    }
+    return undefined;
+}
+/** `super(actor)` or `super(input.actor)`, where the first name is a parameter of the constructor. */
+function forwardsParameter(call, constructor) {
+    let root = call.arguments[0];
+    while (root?.type === AST_NODE_TYPES.MemberExpression) {
+        root = root.object;
+    }
+    if (root?.type !== AST_NODE_TYPES.Identifier) {
+        return false;
+    }
+    const given = root.name;
+    return constructor.value.params
+        .map(parameterBinding)
+        .some((binding) => binding.type === AST_NODE_TYPES.Identifier && binding.name === given);
+}
+//# sourceMappingURL=authz-declared.js.map

package/dist/rules/authz-declared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-declared.js","sourceRoot":"","sources":["../../src/rules/authz-declared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAgC,MAAM,0BAA0B,CAAC;AACxF,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAkB,MAAM,kCAAkC,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,+CAA+C,CAAC;AACtG,OAAO,EAAE,cAAc,EAAE,MAAM,6CAA6C,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,8CAA8C,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAE5D,OAAO,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,WAAW,EAAoB,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAKzE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AACpD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC;AACpE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;AACrD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAE3E,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAY;IACjD,EAAE,EAAE,gBAAgB;IACpB,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,OAAO;IACpB,WAAW,EACT,qLAAqL;IACvL,QAAQ,EAAE;QACR,OAAO,EACL,iOAAiO;QACnO,OAAO,EAAE,uIAAuI,kBAAkB,mFAAmF;QACrP,KAAK,EACH,6JAA6J;QAC/J,aAAa,EACX,uJAAuJ;QACzJ,KAAK,EACH,uQAAuQ;KAC1Q;IACD,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE;QAC1C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,SAAS,CAAC;QACvD,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAEpF,MAAM,IAAI,GAAG,CAAC,OAAgB,EAAQ,EAAE;YACtC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;YAClB,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,UAAU,GAAG,CAAC,IAAe,EAAQ,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QAE3E,OAAO;YACL,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;YACrE,cAAc,CAAC,IAAI;gBACjB,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;gBACvD,CAAC;gBAED,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9B,CAAC;YACD,gBAAgB,EAAE,UAAU;YAC5B,eAAe,EAAE,UAAU;SAC5B,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,6GAA6G;AAC7G,SAAS,kBAAkB,CAAC,IAAgB,EAAE,OAAyB;IACrE,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEtE,IAAI,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACpF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,cAAc,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAElD,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,MAAM,CAC5C,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAC/F,CAAC;IAEF,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3B,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;QACrB,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE;KACxD,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,iBAAiB,CACxB,IAA6B,EAC7B,UAAyC,EACzC,SAAsB;IAEtB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAErG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC;IAE7B,IACE,YAAY,KAAK,SAAS;QAC1B,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EACjD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC;IAE9C,IAAI,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAErF,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AAC7G,CAAC;AAED,8GAA8G;AAC9G,SAAS,iBAAiB,CAAC,OAAoD,EAAE,SAAsB;IACrG,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,KAAK,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE/F,OAAO,CACL,IAAI,KAAK,SAAS;QAClB,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAC1G,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAA6B;IACpD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;IAE9B,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,aAAa,IAAI,IAAI,EAAE,IAAI,KAAK,cAAc,CAAC,gBAAgB,EAAE,CAAC;QACzF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAEtC,OAAO,SAAS,KAAK,SAAS;QAC5B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;AACnG,CAAC;AAED,SAAS,aAAa,CAAC,IAA+B;IACpD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAE9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IAC/C,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAE3B,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,eAAe,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACtG,CAAC;AAED,SAAS,UAAU,CAAC,IAA+B;IACjD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAE1E,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC;AAC7D,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAe;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9E,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE7C,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QACnF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IAEpC,IAAI,IAAI,KAAK,SAAS,IAAI,iBAAiB,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;QAC/D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;AACxF,CAAC;AAED,SAAS,QAAQ,CAAC,UAA+B;IAC/C,IAAI,UAAU,CAAC,IAAI,KAAK,cAAc,CAAC,UAAU,EAAE,CAAC;QAClD,OAAO,UAAU,CAAC,IAAI,CAAC;IACzB,CAAC;IAED,OAAO,UAAU,CAAC,IAAI,KAAK,cAAc,CAAC,gBAAgB,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,KAAK,cAAc,CAAC,UAAU;QAClH,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI;QAC1B,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,WAAsC;IACvD,KAAK,MAAM,SAAS,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;QAC3D,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,KAAK,cAAc,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QAE5G,IAAI,UAAU,EAAE,IAAI,KAAK,cAAc,CAAC,cAAc,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,cAAc,CAAC,KAAK,EAAE,CAAC;YAC1G,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,sGAAsG;AACtG,SAAS,iBAAiB,CAAC,IAA6B,EAAE,WAAsC;IAC9F,IAAI,IAAI,GAA8B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAExD,OAAO,IAAI,EAAE,IAAI,KAAK,cAAc,CAAC,gBAAgB,EAAE,CAAC;QACtD,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,IAAI,IAAI,EAAE,IAAI,KAAK,cAAc,CAAC,UAAU,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC;IAExB,OAAO,WAAW,CAAC,KAAK,CAAC,MAAM;SAC5B,GAAG,CAAC,gBAAgB,CAAC;SACrB,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,cAAc,CAAC,UAAU,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;AAC7F,CAAC"}

package/dist/rules/authz-in-application.d.ts

@@ -0,0 +1,5 @@
+import { type TSESLint } from '@typescript-eslint/utils';
+type MessageId = 'declaredOutside' | 'rights' | 'roleTest' | 'authorizerImport' | 'decision' | 'refusal' | 'authInDomain' | 'actorInDomain' | 'rightsInDomain';
+export declare const authzInApplication: TSESLint.RuleModule<MessageId, [], import("../index.js").RuleDocs, TSESLint.RuleListener>;
+export {};
+//# sourceMappingURL=authz-in-application.d.ts.map

package/dist/rules/authz-in-application.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-in-application.d.ts","sourceRoot":"","sources":["../../src/rules/authz-in-application.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,QAAQ,EAAiB,MAAM,0BAA0B,CAAC;AAaxF,KAAK,SAAS,GACV,iBAAiB,GACjB,QAAQ,GACR,UAAU,GACV,kBAAkB,GAClB,UAAU,GACV,SAAS,GACT,cAAc,GACd,eAAe,GACf,gBAAgB,CAAC;AAqCrB,eAAO,MAAM,kBAAkB,2FAmC7B,CAAC"}

package/dist/rules/authz-in-application.js

@@ -0,0 +1,202 @@
+import { AST_NODE_TYPES } from '@typescript-eslint/utils';
+import { ancestors } from '../support/ancestors.js';
+import { accessedName } from '../support/calls/accessed-name.js';
+import { DECLARATIONS_ENTRY } from '../support/declarations/declaration-reader.js';
+import { isDeclaredStyle } from '../support/declarations/is-declared-style.js';
+import { defineRule } from '../support/rule/define-rule.js';
+import { propertyName } from '../support/globals/property-name.js';
+import { importListener } from '../support/imports/import-listener.js';
+import { inContext } from '../support/imports/in-context.js';
+import { declaredTypeName } from '../support/types/declared-type-name.js';
+import { startsAtThis } from '../support/members/starts-at-this.js';
+const AUTH = '@ddd-ts-kit/auth';
+const KERNEL = '@ddd-ts-kit/kernel';
+const RIGHTS = new Set(['roles', 'permissions']);
+const RIGHTS_AT_THE_BOUNDARY = new Set([...RIGHTS, 'isAdmin']);
+const EQUALITY = new Set(['===', '!==', '==', '!=']);
+/** What a route needs of the auth package: the actor and the session of the request, and the errors it may map. */
+const REQUEST_GLUE = new Set([
+    'actorOf',
+    'sessionOf',
+    'resolveSession',
+    'SessionAuthenticator',
+    'bearerCredential',
+    'inActorContext',
+    'principalResolver',
+    'HeaderValues',
+    'FORBIDDEN',
+    'UNAUTHORIZED',
+]);
+const DECISIONS = new Set(['authorize', 'decide', 'check']);
+const AUTHORIZER_NAME = /^#?access$|authorizer/i;
+const AUTHORIZER_TYPE = /^Access$|Authorizer$/;
+const ACTOR_MODEL = new Set(['Actor', 'Actored', 'ActorContext', 'Session', 'ExecutionContext']);
+/** The declarations that say or decide who may do what: they belong on a message or a policy of application/. */
+const ACCESS_DECLARATIONS = new Set(['Requires', 'Public', 'Policy']);
+/** The ports a handler asks for a decision: the class is the type and the injection token. */
+const ACCESS_PORTS = new Set(['Access', 'PolicyAccess']);
+const IN_APPLICATION = 'Declare the permission on the use case (`.requires(...)` in the module, or `@Requires(...)` on the message) and, for a rule that needs loaded state, write a policy in application/authorization evaluated by the handler through `Access`.';
+export const authzInApplication = defineRule({
+    id: 'authz/in-application',
+    type: 'problem',
+    recommended: 'error',
+    description: 'The permission is decided in the application layer through the Authorizer and Access ports: no role test in presentation/, no authorization in infrastructure/, no knowledge of rights in domain/.',
+    messages: {
+        declaredOutside: `{{layer}}/ imports {{name}} from "{{specifier}}": who may do what is declared and decided in application/. Put \`@Requires(...)\` or \`@Public()\` on the command or query, write a rule that needs loaded state as a \`@Policy\` class of application/authorization, and name \`Access\` in the dependency list of a handler only.`,
+        rights: `presentation/ reads {{access}}: a route maps a request to a command and decides nothing. Put the actor in the command or query and remove the test. ${IN_APPLICATION}`,
+        roleTest: `presentation/ compares {{access}} with a role name. Put the actor in the command or query and remove the test. ${IN_APPLICATION}`,
+        authorizerImport: `presentation/ imports {{name}} from "${AUTH}", which decides access. Keep only the request glue here (actorOf, sessionOf, resolveSession, a SessionAuthenticator, inActorContext, the error classes). ${IN_APPLICATION}`,
+        decision: `infrastructure/ asks {{call}}() for a decision: an adapter does what it is told. Receive an access scope computed by the handler as a parameter of the port instead. ${IN_APPLICATION}`,
+        refusal: `infrastructure/ raises ForbiddenError: refusing is a decision of the application layer. Return what was found (or nothing) and let the handler refuse. ${IN_APPLICATION}`,
+        authInDomain: `domain/ imports "${AUTH}": the domain knows nothing of who may do what. Keep invariants here ("an invoice cannot be paid twice") and move the rule about the actor to a policy in application/authorization.`,
+        actorInDomain: `domain/ imports {{name}} from "${KERNEL}": the domain never sees the actor, its session or the execution context. Pass the fact the model needs as its own value (an author id, a tenant id) and keep the actor in the handler.`,
+        rightsInDomain: 'domain/ reads {{access}}: rights are not part of the model. Let a policy of application/authorization decide and call the aggregate only once the decision is taken.',
+    },
+    create({ file, sourceCode, report }) {
+        const here = inContext(file);
+        if (here === undefined || file.isTest) {
+            return {};
+        }
+        if (here.layer === 'presentation') {
+            return presentation(file, sourceCode, report);
+        }
+        if (here.layer === 'infrastructure') {
+            return infrastructure(file, sourceCode, report);
+        }
+        return here.layer === 'domain' ? domain(file, sourceCode, report) : {};
+    },
+});
+function presentation(file, sourceCode, tell) {
+    const tellDeclaredOutside = declaredOutside(file, 'presentation', tell);
+    const roleTest = (node, tested) => {
+        if (isRole(tested)) {
+            tell({ node, messageId: 'roleTest', data: { access: sourceCode.getText(tested) } });
+        }
+    };
+    return {
+        ...importListener(file, (site) => {
+            tellDeclaredOutside(site);
+            tellAuthorizerImport(site, tell);
+        }),
+        MemberExpression(node) {
+            if (RIGHTS_AT_THE_BOUNDARY.has(propertyName(node) ?? '')) {
+                tell({ node, messageId: 'rights', data: { access: sourceCode.getText(node) } });
+            }
+        },
+        BinaryExpression(node) {
+            if (!EQUALITY.has(node.operator)) {
+                return;
+            }
+            if (isText(node.right)) {
+                roleTest(node, node.left);
+            }
+            if (isText(node.left)) {
+                roleTest(node, node.right);
+            }
+        },
+        SwitchStatement: (node) => roleTest(node.discriminant, node.discriminant),
+    };
+}
+function tellAuthorizerImport({ node, target, names, whole }, tell) {
+    if (target.kind !== 'package' || target.name !== AUTH) {
+        return;
+    }
+    if (whole) {
+        tell({ node, messageId: 'authorizerImport', data: { name: 'the whole module' } });
+    }
+    for (const decider of names.filter(decidesAccess)) {
+        tell({ node: decider.node, messageId: 'authorizerImport', data: { name: decider.name } });
+    }
+}
+/**
+ * In a declared-style project the decorators of access and the `Access` port are within reach of
+ * every layer: they stay in application/. `Access` in presentation/ is already an `authorizerImport`.
+ */
+function declaredOutside(file, layer, tell) {
+    const declares = isDeclaredStyle(file);
+    return (site) => {
+        for (const taken of declares ? takenOutside(layer, site) : []) {
+            tell({
+                node: taken.node,
+                messageId: 'declaredOutside',
+                data: { layer, name: taken.name, specifier: site.specifier },
+            });
+        }
+    };
+}
+function takenOutside(layer, { specifier, target, names }) {
+    if (specifier === DECLARATIONS_ENTRY) {
+        return names.filter((taken) => ACCESS_DECLARATIONS.has(taken.name));
+    }
+    const fromAuth = target.kind === 'package' && target.name === AUTH;
+    return layer === 'infrastructure' && fromAuth ? names.filter((taken) => ACCESS_PORTS.has(taken.name)) : [];
+}
+function decidesAccess(imported) {
+    return !REQUEST_GLUE.has(imported.name) && !imported.name.endsWith('Error');
+}
+function isRole(node) {
+    return node.type === AST_NODE_TYPES.MemberExpression && propertyName(node) === 'role';
+}
+function isText(node) {
+    return node.type === AST_NODE_TYPES.Literal && typeof node.value === 'string';
+}
+function infrastructure(file, sourceCode, tell) {
+    const imports = importListener(file, declaredOutside(file, 'infrastructure', tell));
+    return {
+        ...imports,
+        CallExpression(node) {
+            imports.CallExpression?.(node);
+            const { callee } = node;
+            if (callee.type !== AST_NODE_TYPES.MemberExpression || !DECISIONS.has(propertyName(callee) ?? '')) {
+                return;
+            }
+            if (!isAuthorizer(sourceCode, callee.object) || isAuthorizerAdapter(node)) {
+                return;
+            }
+            tell({ node, messageId: 'decision', data: { call: sourceCode.getText(callee) } });
+        },
+        NewExpression(node) {
+            if (node.callee.type === AST_NODE_TYPES.Identifier && node.callee.name === 'ForbiddenError') {
+                tell({ node, messageId: 'refusal' });
+            }
+        },
+    };
+}
+function isAuthorizer(sourceCode, node) {
+    return (AUTHORIZER_NAME.test(accessedName(node) ?? '') || AUTHORIZER_TYPE.test(declaredTypeName(sourceCode, node) ?? ''));
+}
+/** An adapter of the Authorizer port (a cache, a remote service) decides by definition: it may delegate to another one. */
+function isAuthorizerAdapter(node) {
+    for (const parent of ancestors(node)) {
+        if (parent.type !== AST_NODE_TYPES.ClassDeclaration && parent.type !== AST_NODE_TYPES.ClassExpression) {
+            continue;
+        }
+        return parent.implements.some((port) => port.expression.type === AST_NODE_TYPES.Identifier && port.expression.name.endsWith('Authorizer'));
+    }
+    return false;
+}
+function domain(file, sourceCode, tell) {
+    return {
+        ...importListener(file, ({ node, target, names }) => {
+            if (target.kind !== 'package') {
+                return;
+            }
+            if (target.name === AUTH) {
+                tell({ node, messageId: 'authInDomain' });
+            }
+            if (target.name !== KERNEL) {
+                return;
+            }
+            for (const actor of names.filter((imported) => ACTOR_MODEL.has(imported.name))) {
+                tell({ node: actor.node, messageId: 'actorInDomain', data: { name: actor.name } });
+            }
+        }),
+        MemberExpression(node) {
+            // `this.roles` is the state of a model whose subject is access itself (an identity context), not a test of the caller.
+            if (RIGHTS.has(propertyName(node) ?? '') && !startsAtThis(node)) {
+                tell({ node, messageId: 'rightsInDomain', data: { access: sourceCode.getText(node) } });
+            }
+        },
+    };
+}
+//# sourceMappingURL=authz-in-application.js.map

package/dist/rules/authz-in-application.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-in-application.js","sourceRoot":"","sources":["../../src/rules/authz-in-application.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAgC,MAAM,0BAA0B,CAAC;AACxF,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,+CAA+C,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,8CAA8C,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAe,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAsC,MAAM,uCAAuC,CAAC;AAC3G,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAE7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAepE,MAAM,IAAI,GAAG,kBAAkB,CAAC;AAChC,MAAM,MAAM,GAAG,oBAAoB,CAAC;AACpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;AACjD,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAC/D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAErD,mHAAmH;AACnH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,SAAS;IACT,WAAW;IACX,gBAAgB;IAChB,sBAAsB;IACtB,kBAAkB;IAClB,gBAAgB;IAChB,mBAAmB;IACnB,cAAc;IACd,WAAW;IACX,cAAc;CACf,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAC5D,MAAM,eAAe,GAAG,wBAAwB,CAAC;AACjD,MAAM,eAAe,GAAG,sBAAsB,CAAC;AAC/C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC;AACjG,iHAAiH;AACjH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEtE,8FAA8F;AAC9F,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;AAEzD,MAAM,cAAc,GAClB,6OAA6O,CAAC;AAEhP,MAAM,CAAC,MAAM,kBAAkB,GAAG,UAAU,CAAY;IACtD,EAAE,EAAE,sBAAsB;IAC1B,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,OAAO;IACpB,WAAW,EACT,oMAAoM;IACtM,QAAQ,EAAE;QACR,eAAe,EAAE,qUAAqU;QACtV,MAAM,EAAE,uJAAuJ,cAAc,EAAE;QAC/K,QAAQ,EAAE,kHAAkH,cAAc,EAAE;QAC5I,gBAAgB,EAAE,wCAAwC,IAAI,6JAA6J,cAAc,EAAE;QAC3O,QAAQ,EAAE,wKAAwK,cAAc,EAAE;QAClM,OAAO,EAAE,0JAA0J,cAAc,EAAE;QACnL,YAAY,EAAE,oBAAoB,IAAI,sLAAsL;QAC5N,aAAa,EAAE,kCAAkC,MAAM,yLAAyL;QAChP,cAAc,EACZ,sKAAsK;KACzK;IACD,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE;QACjC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAE7B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,KAAK,cAAc,EAAE,CAAC;YAClC,OAAO,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,KAAK,gBAAgB,EAAE,CAAC;YACpC,OAAO,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,CAAC;CACF,CAAC,CAAC;AAEH,SAAS,YAAY,CAAC,IAAgB,EAAE,UAAkB,EAAE,IAAU;IACpE,MAAM,mBAAmB,GAAG,eAAe,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IAExE,MAAM,QAAQ,GAAG,CAAC,IAAmB,EAAE,MAAqB,EAAQ,EAAE;QACpE,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;YAC/B,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAC1B,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC,CAAC;QACF,gBAAgB,CAAC,IAAI;YACnB,IAAI,sBAAsB,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBACzD,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;QACD,gBAAgB,CAAC,IAAI;YACnB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjC,OAAO;YACT,CAAC;YAED,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;YAED,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,eAAe,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAc,EAAE,IAAU;IAClF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACtD,OAAO;IACT,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,IAAgB,EAChB,KAAwC,EACxC,IAAU;IAEV,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAEvC,OAAO,CAAC,IAAI,EAAE,EAAE;QACd,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC9D,IAAI,CAAC;gBACH,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,SAAS,EAAE,iBAAiB;gBAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;aAC7D,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,KAAwC,EACxC,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAc;IAExC,IAAI,SAAS,KAAK,kBAAkB,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC;IAEnE,OAAO,KAAK,KAAK,gBAAgB,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7G,CAAC;AAED,SAAS,aAAa,CAAC,QAAsB;IAC3C,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,MAAM,CAAC,IAAmB;IACjC,OAAO,IAAI,CAAC,IAAI,KAAK,cAAc,CAAC,gBAAgB,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC;AACxF,CAAC;AAED,SAAS,MAAM,CAAC,IAAmB;IACjC,OAAO,IAAI,CAAC,IAAI,KAAK,cAAc,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC;AAChF,CAAC;AAED,SAAS,cAAc,CAAC,IAAgB,EAAE,UAAkB,EAAE,IAAU;IACtE,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC;IAEpF,OAAO;QACL,GAAG,OAAO;QACV,cAAc,CAAC,IAAI;YACjB,OAAO,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,CAAC;YAC/B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;YAExB,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAClG,OAAO;YACT,CAAC;YAED,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1E,OAAO;YACT,CAAC;YAED,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,aAAa,CAAC,IAAI;YAChB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,cAAc,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBAC5F,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,UAAkB,EAAE,IAAmB;IAC3D,OAAO,CACL,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CACjH,CAAC;AACJ,CAAC;AAED,2HAA2H;AAC3H,SAAS,mBAAmB,CAAC,IAAmB;IAC9C,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,CAAC,gBAAgB,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,CAAC,eAAe,EAAE,CAAC;YACtG,SAAS;QACX,CAAC;QAED,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAC3B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,cAAc,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAC5G,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,IAAgB,EAAE,UAAkB,EAAE,IAAU;IAC9D,OAAO;QACL,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE;YAClD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO;YACT,CAAC;YAED,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACzB,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;YAC5C,CAAC;YAED,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC3B,OAAO;YACT,CAAC;YAED,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC/E,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;QACH,CAAC,CAAC;QACF,gBAAgB,CAAC,IAAI;YACnB,uHAAuH;YACvH,IAAI,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChE,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/rules/clean-file-size.d.ts

@@ -0,0 +1,2 @@
+export declare const cleanFileSize: import("@typescript-eslint/utils/ts-eslint").RuleModule<"tooLong", [], import("../index.js").RuleDocs, import("@typescript-eslint/utils/ts-eslint").RuleListener>;
+//# sourceMappingURL=clean-file-size.d.ts.map

package/dist/rules/clean-file-size.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clean-file-size.d.ts","sourceRoot":"","sources":["../../src/rules/clean-file-size.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,aAAa,mKAwBxB,CAAC"}

package/dist/rules/clean-file-size.js

@@ -0,0 +1,25 @@
+import { defineRule } from '../support/rule/define-rule.js';
+const MAX_LINES = 350;
+export const cleanFileSize = defineRule({
+    id: 'clean/file-size',
+    type: 'suggestion',
+    recommended: 'error',
+    description: 'A file is at most 350 lines, tests included: past that it holds more than one responsibility.',
+    messages: {
+        tooLong: 'This file is {{count}} lines long (limit {{limit}}). It holds more than one responsibility: move each one to a file named after it (a class, a function with the types of its signature, a group of tests about one behaviour) until every file reads in one sitting.',
+    },
+    create({ file, sourceCode, report }) {
+        if (file.path.endsWith('.d.ts') || file.path.split('/').includes('generated')) {
+            return {};
+        }
+        return {
+            Program() {
+                const count = sourceCode.lines.at(-1) === '' ? sourceCode.lines.length - 1 : sourceCode.lines.length;
+                if (count > MAX_LINES) {
+                    report({ loc: { line: MAX_LINES + 1, column: 0 }, messageId: 'tooLong', data: { count, limit: MAX_LINES } });
+                }
+            },
+        };
+    },
+});
+//# sourceMappingURL=clean-file-size.js.map

package/dist/rules/clean-file-size.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clean-file-size.js","sourceRoot":"","sources":["../../src/rules/clean-file-size.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAE5D,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAY;IACjD,EAAE,EAAE,iBAAiB;IACrB,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,OAAO;IACpB,WAAW,EAAE,+FAA+F;IAC5G,QAAQ,EAAE;QACR,OAAO,EACL,uQAAuQ;KAC1Q;IACD,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE;QACjC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9E,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO;YACL,OAAO;gBACL,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;gBAErG,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;oBACtB,MAAM,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;gBAC/G,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/dist/rules/clean-function-ceiling.d.ts

@@ -0,0 +1,6 @@
+/**
+ * The hard ceiling of clean/function-size. ESLint gives one severity to a rule name, so the
+ * part that is an error whatever the configured limit is a rule of its own.
+ */
+export declare const cleanFunctionCeiling: import("@typescript-eslint/utils/ts-eslint").RuleModule<"ceiling", [], import("../index.js").RuleDocs, import("@typescript-eslint/utils/ts-eslint").RuleListener>;
+//# sourceMappingURL=clean-function-ceiling.d.ts.map

package/dist/rules/clean-function-ceiling.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clean-function-ceiling.d.ts","sourceRoot":"","sources":["../../src/rules/clean-function-ceiling.ts"],"names":[],"mappings":"AAMA;;;GAGG;AACH,eAAO,MAAM,oBAAoB,mKA0B/B,CAAC"}