@jameswyse/oxc-config 0.2.0 → 0.3.0

package/dist/index.js

@@ -10,15 +10,28 @@ import { noAmbientClock } from "./rules/no-ambient-clock.js";
 import { noAmbientRandom } from "./rules/no-ambient-random.js";
 import { noComments } from "./rules/no-comments.js";
 import { noDeepTernary } from "./rules/no-deep-ternary.js";
+import { noDerivedTestExpectation } from "./rules/no-derived-test-expectation.js";
+import { noDisabledTlsVerification } from "./rules/no-disabled-tls-verification.js";
 import { noEditProofAssertions } from "./rules/no-edit-proof-assertions.js";
 import { noEnvAccess } from "./rules/no-env-access.js";
 import { noFixedTestDelay } from "./rules/no-fixed-test-delay.js";
 import { noForwardingModule } from "./rules/no-forwarding-module.js";
 import { noGenericFileSuffix } from "./rules/no-generic-file-suffix.js";
+import { noGenericObjectGuard } from "./rules/no-generic-object-guard.js";
+import { noGetPasswordForm } from "./rules/no-get-password-form.js";
+import { noHardcodedCredential } from "./rules/no-hardcoded-credential.js";
+import { noImportTimeEffects } from "./rules/no-import-time-effects.js";
+import { noOptionalTestAction } from "./rules/no-optional-test-action.js";
 import { noPassThroughFunction } from "./rules/no-pass-through-function.js";
+import { noSecretFallback } from "./rules/no-secret-fallback.js";
 import { noSwallowedErrors } from "./rules/no-swallowed-errors.js";
 import { noTestTimeoutOverrides } from "./rules/no-test-timeout-overrides.js";
+import { noUncheckedFetchResponse } from "./rules/no-unchecked-fetch-response.js";
+import { noUncheckedIndexSearch } from "./rules/no-unchecked-index-search.js";
+import { noUncontrolledTestClock } from "./rules/no-uncontrolled-test-clock.js";
+import { noUnsettledPromise } from "./rules/no-unsettled-promise.js";
 import { noVacuousTestAssertions } from "./rules/no-vacuous-test-assertions.js";
+import { requireSuppressionReason } from "./rules/require-suppression-reason.js";
 import { serverActionGuard } from "./rules/server-action-guard.js";
 import { statementSpacing } from "./rules/statement-spacing.js";
 import { typeGuardName } from "./rules/type-guard-name.js";
@@ -66,29 +79,42 @@ const wyse = definePlugin({
         "no-comments": noComments,
         "no-conditional-empty-object-spread": noConditionalEmptyObjectSpread,
         "no-deep-ternary": noDeepTernary,
+        "no-derived-test-expectation": noDerivedTestExpectation,
+        "no-disabled-tls-verification": noDisabledTlsVerification,
         "no-edit-proof-assertions": noEditProofAssertions,
         "no-env-access": noEnvAccess,
         "no-fixed-test-delay": noFixedTestDelay,
         "no-forwarding-module": noForwardingModule,
         "no-generic-file-suffix": noGenericFileSuffix,
+        "no-generic-object-guard": noGenericObjectGuard,
+        "no-get-password-form": noGetPasswordForm,
+        "no-hardcoded-credential": noHardcodedCredential,
+        "no-import-time-effects": noImportTimeEffects,
         "no-known-value-widening": noKnownValueWidening,
         "no-manual-effect-error-tag": noManualEffectErrorTag,
         "no-module-mocking": noModuleMocking,
         "no-object-parameters": noObjectParameters,
+        "no-optional-test-action": noOptionalTestAction,
         "no-pass-through-function": noPassThroughFunction,
         "no-reduce-accumulator-copy": noReduceAccumulatorCopy,
         "no-reflect-apply": noReflectApply,
         "no-reflect-get": noReflectGet,
         "no-runtime-typeof": noRuntimeTypeof,
+        "no-secret-fallback": noSecretFallback,
         "no-service-constructor-imports": noServiceConstructorImports,
         "no-shape-in-symbol-names": noForbiddenTermInSymbolNames,
         "no-swallowed-errors": noSwallowedErrors,
         "no-test-timeout-overrides": noTestTimeoutOverrides,
+        "no-unchecked-fetch-response": noUncheckedFetchResponse,
+        "no-unchecked-index-search": noUncheckedIndexSearch,
+        "no-uncontrolled-test-clock": noUncontrolledTestClock,
         "no-unknown-returns": noUnknownReturns,
         "no-unknown-type-aliases": noUnknownTypeAliases,
         "no-unsafe-dictionary-type": noUnsafeDictionaryType,
+        "no-unsettled-promise": noUnsettledPromise,
         "no-vacuous-test-assertions": noVacuousTestAssertions,
         "no-widen-then-assert": noWidenThenAssert,
+        "require-suppression-reason": requireSuppressionReason,
         "server-action-guard": serverActionGuard,
         "statement-spacing": statementSpacing,
         "type-guard-name": typeGuardName,

package/dist/lint.d.ts

@@ -24,6 +24,7 @@ export interface ImportBoundary {
     ignore?: string[];
     deny: string[];
     message: string;
+    types?: boolean;
 }
 export type SharedLintConfig = OxlintConfig & {
     ignorePatterns: string[];

package/dist/lint.js

@@ -4,6 +4,7 @@ import { fileURLToPath } from "node:url";
 const require = createRequire(import.meta.url);
 const sourceFiles = ["**/*.{js,jsx,mjs,cjs,ts,tsx,mts,cts}"];
 const typeScriptFiles = ["**/*.{ts,tsx,mts,cts}"];
+const javaScriptFiles = ["**/*.{js,jsx,mjs,cjs}"];
 const testFiles = [
     "**/*.{test,spec}.{js,jsx,mjs,cjs,ts,tsx,mts,cts}",
     "**/__tests__/**/*.{js,jsx,mjs,cjs,ts,tsx,mts,cts}",
@@ -35,12 +36,19 @@ const defaultExportFiles = [
     "**/*.stories.{js,jsx,mjs,ts,tsx,mts}",
     "**/.storybook/**/*.{js,jsx,mjs,cjs,ts,tsx,mts,cts}",
 ];
+const programFiles = [
+    "**/{bin,cli,deploy,tools,test,tests,e2e,fixtures}/**/*.{js,jsx,mjs,cjs,ts,tsx,mts,cts}",
+    "**/.storybook/**/*.{js,jsx,mjs,cjs,ts,tsx,mts,cts}",
+    "**/{main,server,worker,instrumentation,instrumentation-client,healthcheck}.{js,jsx,mjs,cjs,ts,tsx,mts,cts}",
+];
 const endToEndFiles = ["**/e2e/**", "**/*.e2e.{js,jsx,mjs,cjs,ts,tsx,mts,cts}"];
 const electronRendererFiles = ["src/renderer/**/*.{js,jsx,mjs,cjs,ts,tsx,mts,cts}"];
 const testRules = {
     "wyse/no-fixed-test-delay": "error",
     "wyse/no-vacuous-test-assertions": "error",
     "wyse/no-edit-proof-assertions": "error",
+    "wyse/no-optional-test-action": "error",
+    "wyse/no-derived-test-expectation": "warn",
     "wyse/companion-has-owner": "warn",
 };
 const basePlugins = ["eslint", "unicorn", "oxc", "import", "promise", "typescript"];
@@ -70,6 +78,43 @@ function reactScope(react, nextjs) {
     const files = [...(react || []), ...(nextjs || [])];
     return files.length > 0 ? [...new Set(files)] : false;
 }
+const nativeGuards = {
+    ...errors("eslint", [
+        "array-callback-return",
+        "no-array-constructor",
+        "no-case-declarations",
+        "no-constructor-return",
+        "no-fallthrough",
+        "no-loop-func",
+        "no-new-func",
+        "no-new-wrappers",
+        "no-proto",
+        "no-prototype-builtins",
+        "no-self-compare",
+        "no-unreachable-loop",
+        "no-useless-assignment",
+        "no-var",
+        "prefer-object-has-own",
+        "prefer-rest-params",
+    ]),
+    "eslint/prefer-regex-literals": ["error", { disallowRedundantWrapping: true }],
+    ...errors("unicorn", [
+        "error-message",
+        "new-for-builtins",
+        "no-instanceof-array",
+        "no-new-buffer",
+        "prefer-array-find",
+        "prefer-array-flat-map",
+        "prefer-array-some",
+        "prefer-import-meta-properties",
+        "prefer-node-protocol",
+        "prefer-response-static-json",
+        "prefer-string-trim-start-end",
+    ]),
+    "import/no-mutable-exports": "error",
+    "oxc/no-const-enum": "error",
+};
+const javaScriptOnlyRules = errors("eslint", ["no-throw-literal", "prefer-promise-reject-errors"]);
 const baseErrors = errors("wyse", [
     "no-array-filter-map",
     "no-reduce-accumulator-copy",
@@ -99,10 +144,23 @@ const typeAwareRules = {
         "no-unsafe-return",
         "no-unsafe-type-assertion",
         "only-throw-error",
+        "prefer-promise-reject-errors",
         "prefer-readonly",
+        "prefer-reduce-type-parameter",
         "return-await",
         "switch-exhaustiveness-check",
+        "use-unknown-in-catch-callback-variable",
     ]),
+    "typescript/restrict-plus-operands": [
+        "error",
+        {
+            allowAny: false,
+            allowBoolean: false,
+            allowNullish: false,
+            allowNumberAndString: false,
+            allowRegExp: false,
+        },
+    ],
     "typescript/no-floating-promises": [
         "error",
         {
@@ -250,7 +308,14 @@ const testRuleNames = [
     "no-duplicate-hooks",
     "no-focused-tests",
     "no-identical-title",
+    "no-interpolation-in-snapshots",
     "no-standalone-expect",
+    "no-unneeded-async-expect-function",
+    "prefer-comparison-matcher",
+    "prefer-equality-matcher",
+    "prefer-strict-equal",
+    "prefer-to-contain",
+    "prefer-to-have-length",
     "valid-describe-callback",
     "valid-expect",
     "valid-expect-in-promise",
@@ -273,13 +338,32 @@ export function createLintConfig({ root, typeAware = true, node = false, react =
     const jsPlugins = [wysePlugin];
     const typescriptRules = {
         ...errors("typescript", [
-            "ban-ts-comment",
             "consistent-type-imports",
             "no-explicit-any",
             "no-non-null-assertion",
             "no-empty-object-type",
             "no-unnecessary-type-constraint",
         ]),
+        "typescript/ban-ts-comment": [
+            "error",
+            {
+                "ts-expect-error": { descriptionFormat: "^\\s*-{2,}\\s+\\S" },
+                "ts-ignore": true,
+                "ts-nocheck": true,
+                "ts-check": false,
+            },
+        ],
+        "typescript/consistent-type-assertions": [
+            "error",
+            {
+                assertionStyle: "as",
+                objectLiteralTypeAssertions: "never",
+                arrayLiteralTypeAssertions: "never",
+            },
+        ],
+        "typescript/method-signature-style": ["error", "property"],
+        "typescript/no-import-type-side-effects": "error",
+        "typescript/no-unsafe-function-type": "error",
         "wyse/type-guard-name": "error",
     };
     const overrides = [
@@ -297,11 +381,28 @@ export function createLintConfig({ root, typeAware = true, node = false, react =
             files: defaultExportFiles,
             rules: { "import/no-default-export": "off" },
         },
+        { files: javaScriptFiles, rules: javaScriptOnlyRules },
         { files: allTestFiles, rules: testRules },
         {
             files: allTestFiles,
             excludeFiles: endToEndFiles,
-            rules: { "wyse/no-test-timeout-overrides": "warn" },
+            rules: {
+                "wyse/no-test-timeout-overrides": "warn",
+                "wyse/no-uncontrolled-test-clock": "error",
+            },
+        },
+        {
+            files: sourceFiles,
+            excludeFiles: allTestFiles,
+            rules: {
+                "wyse/no-unchecked-fetch-response": "error",
+                "wyse/no-unsettled-promise": "error",
+            },
+        },
+        {
+            files: sourceFiles,
+            excludeFiles: [...allTestFiles, ...entrypointFiles, ...programFiles],
+            rules: { "wyse/no-import-time-effects": "warn" },
         },
     ];
     if (env !== undefined && env.length > 0) {
@@ -351,7 +452,11 @@ export function createLintConfig({ root, typeAware = true, node = false, react =
         });
     }
     if (typeAware) {
-        overrides.unshift({ files: typeScriptFiles, rules: typeAwareRules });
+        overrides.unshift({ files: typeScriptFiles, rules: typeAwareRules }, {
+            files: typeScriptFiles,
+            excludeFiles: allTestFiles,
+            rules: { "typescript/no-deprecated": "warn" },
+        });
     }
     if (node) {
         overrides.push({
@@ -379,6 +484,7 @@ export function createLintConfig({ root, typeAware = true, node = false, react =
                 ...accessibilityRules,
                 "react/exhaustive-deps": "error",
                 "react/no-array-index-key": "error",
+                "wyse/no-get-password-form": "error",
                 "react/react-in-jsx-scope": "off",
                 "jsx-a11y/control-has-associated-label": [
                     "error",
@@ -398,11 +504,18 @@ export function createLintConfig({ root, typeAware = true, node = false, react =
                 "jsx-a11y/label-has-associated-control": ["error", { depth: 25 }],
                 "jsx-a11y/no-noninteractive-tabindex": ["error", { roles: ["region", "tabpanel"] }],
                 "jsx-a11y/prefer-tag-over-role": "off",
+                "react/checked-requires-onchange-or-readonly": "error",
+                "react/jsx-no-useless-fragment": ["error", { allowExpressions: true }],
+                "react/no-unknown-property": "error",
             },
         }, {
             files: reactFiles,
             excludeFiles: allTestFiles,
             rules: { ...reactEffectRules, ...browserPerformanceRules },
+        }, {
+            files: reactFiles,
+            excludeFiles: [...endToEndFiles, "**/tests/**"],
+            rules: { "react/rules-of-hooks": "error" },
         });
     }
     if (nextFiles.length > 0) {
@@ -433,7 +546,7 @@ export function createLintConfig({ root, typeAware = true, node = false, react =
                 plugins: [...basePlugins, name],
                 env: { [name]: true },
                 rules: {
-                    ...errors(name, testRuleNames),
+                    ...errors(name, name === "jest" ? [...testRuleNames, "no-done-callback"] : testRuleNames),
                     ...testRules,
                     [`${name}/no-standalone-expect`]: [
                         "error",
@@ -457,12 +570,19 @@ export function createLintConfig({ root, typeAware = true, node = false, react =
         env: { es2022: true },
         ignorePatterns: defaultIgnores,
         rules: {
+            ...nativeGuards,
             ...baseErrors,
             ...typescriptRules,
             "wyse/no-runtime-typeof": ["warn", { allowInTypeGuards: true }],
             "wyse/no-comments": "error",
+            "wyse/require-suppression-reason": "error",
             "wyse/statement-spacing": "error",
             "wyse/no-generic-file-suffix": "error",
+            "wyse/no-generic-object-guard": "error",
+            "wyse/no-disabled-tls-verification": "error",
+            "wyse/no-hardcoded-credential": "error",
+            "wyse/no-secret-fallback": "error",
+            "wyse/no-unchecked-index-search": "error",
             "wyse/no-swallowed-errors": "warn",
             "wyse/explicit-api-states": "warn",
             "wyse/no-pass-through-function": "warn",

package/dist/rules/explicit-api-states.js

@@ -29,6 +29,12 @@ function isSetter(name, fn, parameter) {
     return (/^(?:set|update)\p{Lu}/u.test(name.slice(name.lastIndexOf(".") + 1)) &&
         fn.params.at(-1) === parameter);
 }
+function isPredicateSubject(fn, identifier) {
+    const predicate = fn.returnType?.typeAnnotation;
+    return (predicate?.type === "TSTypePredicate" &&
+        predicate.parameterName.type === "Identifier" &&
+        predicate.parameterName.name === identifier.name);
+}
 function functionValue(node) {
     return node?.type === "ArrowFunctionExpression" || node?.type === "FunctionExpression"
         ? node
@@ -92,7 +98,7 @@ export const explicitApiStates = defineRule({
             }
             for (const parameter of fn.params) {
                 const identifier = booleanParameter(parameter);
-                if (identifier && !isSetter(name, fn, parameter)) {
+                if (identifier && !isSetter(name, fn, parameter) && !isPredicateSubject(fn, identifier)) {
                     context.report({
                         node: identifier,
                         messageId: "boolean",

package/dist/rules/import-boundaries.js

@@ -1,6 +1,6 @@
 import { dirname, resolve as resolvePath } from "node:path";
 import { defineRule } from "@oxlint/plugins";
-import { projectPath, matchesAny } from "../shared/index.js";
+import { importedBinding, isGlobal, matchesAny, projectPath, variableFor, } from "../shared/index.js";
 function isStringList(value) {
     return Array.isArray(value) && value.every((item) => typeof item === "string");
 }
@@ -8,14 +8,15 @@ function parseBoundary(value) {
     if (typeof value !== "object" || value === null || Array.isArray(value)) {
         throw new TypeError("Each import boundary must be an object.");
     }
-    const { files, ignore = [], deny, message } = value;
+    const { files, ignore = [], deny, message, types = false } = value;
     if (!isStringList(files) ||
         !isStringList(ignore) ||
         !isStringList(deny) ||
-        typeof message !== "string") {
+        typeof message !== "string" ||
+        typeof types !== "boolean") {
         throw new TypeError("Each import boundary needs files, deny and message settings.");
     }
-    return { files, ignore, deny, message };
+    return { files, ignore, deny, message, types };
 }
 function parseSettings(options) {
     const [option] = options;
@@ -28,6 +29,17 @@ function parseSettings(options) {
     }
     return { root: option.root, boundaries: option.boundaries.map(parseBoundary) };
 }
+const nodeModuleSources = new Set(["module", "node:module"]);
+function isRequire(sourceCode, callee) {
+    if (isGlobal(sourceCode, callee, "require")) {
+        return true;
+    }
+    const definition = variableFor(sourceCode, callee)?.defs[0];
+    const init = definition?.node.type === "VariableDeclarator" ? definition.node.init : null;
+    const factory = init?.type === "CallExpression" ? init.callee : null;
+    const binding = factory === null ? null : importedBinding(sourceCode, factory);
+    return (binding !== null && nodeModuleSources.has(binding.source) && binding.name === "createRequire");
+}
 export const importBoundaries = defineRule({
     meta: {
         type: "problem",
@@ -46,6 +58,7 @@ export const importBoundaries = defineRule({
                                 ignore: { type: "array", items: { type: "string" } },
                                 deny: { type: "array", items: { type: "string" } },
                                 message: { type: "string" },
+                                types: { type: "boolean" },
                             },
                             required: ["files", "deny", "message"],
                             additionalProperties: false,
@@ -66,14 +79,14 @@ export const importBoundaries = defineRule({
             return {};
         }
         function check(source, typeOnly) {
-            if (typeOnly || source?.type !== "Literal" || typeof source.value !== "string") {
+            if (source?.type !== "Literal" || typeof source.value !== "string") {
                 return;
             }
             const specifier = source.value;
             const target = specifier.startsWith(".")
                 ? projectPath(root, resolvePath(dirname(context.filename), specifier))
                 : specifier;
-            const boundary = active.find(({ deny }) => matchesAny(target, deny));
+            const boundary = active.find(({ deny, types }) => (types || !typeOnly) && matchesAny(target, deny));
             if (boundary) {
                 context.report({
                     node: source,
@@ -97,6 +110,18 @@ export const importBoundaries = defineRule({
             ImportExpression(node) {
                 check(node.source, false);
             },
+            TSImportType(node) {
+                check(node.source, true);
+            },
+            TSExternalModuleReference(node) {
+                check(node.expression, node.parent.type === "TSImportEqualsDeclaration" && node.parent.importKind === "type");
+            },
+            CallExpression(node) {
+                const [source] = node.arguments;
+                if (node.arguments.length === 1 && isRequire(context.sourceCode, node.callee)) {
+                    check(source, false);
+                }
+            },
         };
     },
 });

package/dist/rules/no-derived-test-expectation.d.ts

@@ -0,0 +1 @@
+export declare const noDerivedTestExpectation: import("@oxlint/plugins").Rule;

package/dist/rules/no-derived-test-expectation.js

@@ -0,0 +1,136 @@
+import { dirname, join } from "node:path";
+import { defineRule } from "@oxlint/plugins";
+import { apiReference, childNodes, projectPath, propertyName, variableFor, } from "../shared/index.js";
+const comparisonMatchers = new Set([
+    "toBe",
+    "toEqual",
+    "toStrictEqual",
+    "toMatchObject",
+    "toContain",
+    "toContainEqual",
+    "toMatch",
+    "toHaveProperty",
+    "toBeCloseTo",
+]);
+const testSupport = /(?:^|[/.])(?:tests?|__tests__|e2e|testing|fixtures?|mocks?|fakes?|stubs?|builders?|factories|support|helpers?)(?:[/.]|$)/u;
+const projectSpecifier = /^(?:\.{1,2}\/|@\/|~\/|#)/u;
+function isProductionImport(sourceCode, directory, callee) {
+    const definition = variableFor(sourceCode, callee)?.defs[0];
+    const declaration = definition?.parent;
+    if (definition?.type !== "ImportBinding" || declaration?.type !== "ImportDeclaration") {
+        return false;
+    }
+    const source = declaration.source.value;
+    const path = source.startsWith(".") ? join(directory, source) : source;
+    return projectSpecifier.test(source) && !testSupport.test(path.replaceAll("\\", "/"));
+}
+function calledName(sourceCode, directory, callee) {
+    if (callee.type === "Identifier") {
+        return isProductionImport(sourceCode, directory, callee) ? callee.name : null;
+    }
+    const name = callee.type === "MemberExpression" ? propertyName(callee) : null;
+    const namespace = callee.type === "MemberExpression" ? callee.object : null;
+    return namespace?.type === "Identifier" &&
+        name !== null &&
+        variableFor(sourceCode, namespace)?.defs[0]?.node.type === "ImportNamespaceSpecifier" &&
+        isProductionImport(sourceCode, directory, namespace)
+        ? `${namespace.name}.${name}`
+        : null;
+}
+function constantValue(sourceCode, node) {
+    const variable = node.type === "Identifier" ? variableFor(sourceCode, node) : null;
+    const definition = variable?.defs[0];
+    return variable !== null &&
+        definition?.type === "Variable" &&
+        definition.parent?.type === "VariableDeclaration" &&
+        definition.parent.kind === "const" &&
+        definition.node.type === "VariableDeclarator" &&
+        definition.node.id.type === "Identifier" &&
+        definition.node.init !== null
+        ? { variable, value: definition.node.init }
+        : null;
+}
+function isExpectedArgument(node) {
+    const call = node.parent;
+    return (call?.type === "CallExpression" &&
+        call.arguments.some((argument) => argument === node) &&
+        call.callee.type === "MemberExpression" &&
+        comparisonMatchers.has(propertyName(call.callee) ?? ""));
+}
+function subjectRoots(sourceCode, argument) {
+    const constant = constantValue(sourceCode, argument);
+    return constant === null ? [argument] : [argument, constant.value];
+}
+function expectedRoot(sourceCode, argument) {
+    const constant = constantValue(sourceCode, argument);
+    return constant !== null &&
+        constant.variable.references.every((reference) => !reference.isRead() || isExpectedArgument(reference.identifier))
+        ? constant.value
+        : argument;
+}
+function productionCalls(sourceCode, directory, root) {
+    const names = [];
+    const pending = [root];
+    for (let node = pending.pop(); node !== undefined; node = pending.pop()) {
+        const name = node.type === "CallExpression" ? calledName(sourceCode, directory, node.callee) : null;
+        if (name !== null) {
+            names.push(name);
+        }
+        if (node.type !== "ArrowFunctionExpression" && node.type !== "FunctionExpression") {
+            pending.push(...childNodes(node, sourceCode.visitorKeys));
+        }
+    }
+    return names;
+}
+function positiveExpectation(sourceCode, node) {
+    let current = node;
+    while (current.type === "MemberExpression") {
+        if (propertyName(current) === "not") {
+            return null;
+        }
+        current = current.object;
+    }
+    return current.type === "CallExpression" &&
+        apiReference(sourceCode, current.callee)?.name === "expect"
+        ? current
+        : null;
+}
+export const noDerivedTestExpectation = defineRule({
+    meta: {
+        type: "suggestion",
+        docs: {
+            description: "Disallow expected values computed by the production code under test.",
+        },
+        schema: [],
+        messages: {
+            derived: "The expected value calls `{{name}}` from production code, so a bug in it changes both sides and the assertion still passes. Write the expected value out, or derive it independently.",
+        },
+    },
+    create(context) {
+        const sourceCode = context.sourceCode;
+        const directory = dirname(projectPath(context.cwd, context.filename));
+        return {
+            CallExpression(node) {
+                const matcher = node.callee.type === "MemberExpression" ? propertyName(node.callee) : null;
+                const expectation = node.callee.type === "MemberExpression" &&
+                    matcher !== null &&
+                    comparisonMatchers.has(matcher)
+                    ? positiveExpectation(sourceCode, node.callee.object)
+                    : null;
+                if (expectation === null) {
+                    return;
+                }
+                const subjectCalls = new Set(expectation.arguments
+                    .flatMap((argument) => subjectRoots(sourceCode, argument))
+                    .flatMap((root) => productionCalls(sourceCode, directory, root)));
+                for (const argument of node.arguments) {
+                    const name = productionCalls(sourceCode, directory, expectedRoot(sourceCode, argument)).find((call) => !subjectCalls.has(call));
+                    if (name !== undefined) {
+                        context.report({ node: argument, messageId: "derived", data: { name } });
+                        return;
+                    }
+                }
+            },
+        };
+    },
+});

package/dist/rules/no-disabled-tls-verification.d.ts

@@ -0,0 +1 @@
+export declare const noDisabledTlsVerification: import("@oxlint/plugins").Rule;

package/dist/rules/no-disabled-tls-verification.js

@@ -0,0 +1,42 @@
+import { defineRule } from "@oxlint/plugins";
+import { isGlobal, staticPropertyName, unwrapExpression } from "../shared/index.js";
+function isFalse(node) {
+    const value = unwrapExpression(node);
+    return value.type === "Literal" && value.value === false;
+}
+function isDisabledFlag(node) {
+    const value = unwrapExpression(node);
+    return (value.type === "Literal" && (value.value === "0" || value.value === 0)) || isFalse(value);
+}
+export const noDisabledTlsVerification = defineRule({
+    meta: {
+        type: "problem",
+        docs: { description: "Disallow turning off TLS certificate verification." },
+        schema: [],
+        messages: {
+            disabled: "This turns off TLS certificate verification, so any server can impersonate the real one. Trust the right certificate authority instead, such as with the `ca` option or `NODE_EXTRA_CA_CERTS`.",
+        },
+    },
+    create(context) {
+        const sourceCode = context.sourceCode;
+        return {
+            Property(node) {
+                if (staticPropertyName(node) === "rejectUnauthorized" && isFalse(node.value)) {
+                    context.report({ node, messageId: "disabled" });
+                }
+            },
+            AssignmentExpression(node) {
+                const target = unwrapExpression(node.left);
+                const environment = target.type === "MemberExpression" ? unwrapExpression(target.object) : null;
+                if (target.type === "MemberExpression" &&
+                    staticPropertyName(target) === "NODE_TLS_REJECT_UNAUTHORIZED" &&
+                    environment?.type === "MemberExpression" &&
+                    staticPropertyName(environment) === "env" &&
+                    isGlobal(sourceCode, unwrapExpression(environment.object), "process") &&
+                    isDisabledFlag(node.right)) {
+                    context.report({ node, messageId: "disabled" });
+                }
+            },
+        };
+    },
+});