@nifrajs/cli 2.13.0 → 2.14.1

package/src/rules/index.ts

@@ -1,6 +1,9 @@
 import type { Diagnostic } from "../diagnostics.ts"
+import type { ProjectFacts } from "../project-facts.ts"
 import { isBuiltInCode } from "./codes.ts"
 
+export type { ProjectFacts } from "../project-facts.ts"
+
 export interface SourceFile {
   readonly file: string
   readonly content: string
@@ -11,10 +14,6 @@ export interface SourceIndex {
   read(file: string): string | undefined
 }
 
-export interface ProjectFacts {
-  readonly [key: string]: unknown
-}
-
 export interface RuleContext {
   readonly root: string
   readonly sources: SourceIndex

package/src/rules/routes.ts

@@ -3,8 +3,8 @@ import { commentBlockHasMarker } from "./comment-markers.ts"
 import type { CheckRule, RuleContext } from "./index.ts"
 
 /**
- * Route-table lints over the statically collected route registrations (`scanStaticRouteText` in
- * ../check.ts fills `ctx.project.staticRoutes` during the source walk - no second scan here).
+ * Route-table lints over the statically collected route registrations (`ProjectFacts.routes` is built
+ * once before the registry runs - no rule re-walks source).
  *
  * NF-C018 exists because the typed client's proxy intercepts a fixed set of property names before
  * path resolution (`resolveSegment` + the thenable guard in @nifrajs/client): the seven HTTP verbs
@@ -41,20 +41,19 @@ interface StaticRouteFact {
 
 /** Parse-don't-cast over the project fact: a malformed entry is dropped, never trusted. */
 function routeFacts(ctx: RuleContext): StaticRouteFact[] {
-  const raw = ctx.project.staticRoutes
-  if (!Array.isArray(raw)) return []
+  const raw: readonly unknown[] = ctx.project.routes
   const out: StaticRouteFact[] = []
   for (const item of raw) {
-    if (typeof item !== "object" || item === null) continue
-    const record = item as Record<string, unknown>
+    if (typeof item !== "object" || item === null || Array.isArray(item)) continue
+    const record = Object.fromEntries(Object.entries(item))
     if (
-      typeof record.file === "string" &&
-      typeof record.line === "number" &&
-      typeof record.method === "string" &&
-      typeof record.path === "string"
-    ) {
-      out.push({ file: record.file, line: record.line, method: record.method, path: record.path })
-    }
+      typeof record.file !== "string" ||
+      typeof record.line !== "number" ||
+      typeof record.method !== "string" ||
+      typeof record.path !== "string"
+    )
+      continue
+    out.push({ file: record.file, line: record.line, method: record.method, path: record.path })
   }
   return out
 }
@@ -91,7 +90,7 @@ export const reservedSegmentRule: CheckRule = {
         if (collision === undefined) continue
         let lines = linesByFile.get(route.file)
         if (lines === undefined) {
-          lines = (ctx.sources.read(route.file) ?? "").split("\n")
+          lines = (ctx.project.source.read(route.file) ?? "").split("\n")
           linesByFile.set(route.file, lines)
         }
         if (commentBlockHasMarker(lines, route.line, RESERVED_SEGMENT_PRAGMA)) continue

package/src/rules/security.ts

@@ -108,8 +108,8 @@ export const secretComparisonRule: CheckRule = {
     const ts = await importProjectTypeScript(ctx.root)
     if (ts === undefined) return didNotRun("NF-S002", "Non-constant-time secret comparison scan")
     const findings: Diagnostic[] = []
-    for (const file of ctx.sources.files) {
-      const parsed = parsedFile(ts, ctx.sources, file)
+    for (const file of ctx.project.source.files) {
+      const parsed = parsedFile(ts, ctx.project.source, file)
       if (parsed === undefined) continue
       const { tree, lines } = parsed
       const visit = (node: TSApi.Node): void => {
@@ -169,8 +169,8 @@ export const piiLogRule: CheckRule = {
     const ts = await importProjectTypeScript(ctx.root)
     if (ts === undefined) return didNotRun("NF-S003", "Sensitive-value-in-log scan")
     const findings: Diagnostic[] = []
-    for (const file of ctx.sources.files) {
-      const parsed = parsedFile(ts, ctx.sources, file)
+    for (const file of ctx.project.source.files) {
+      const parsed = parsedFile(ts, ctx.project.source, file)
       if (parsed === undefined) continue
       const { tree, lines } = parsed
       const visit = (node: TSApi.Node): void => {
@@ -217,8 +217,8 @@ export const failOpenGateRule: CheckRule = {
     const ts = await importProjectTypeScript(ctx.root)
     if (ts === undefined) return didNotRun("NF-S001", "Fail-open gate scan")
     const findings: Diagnostic[] = []
-    for (const file of ctx.sources.files) {
-      const parsed = parsedFile(ts, ctx.sources, file)
+    for (const file of ctx.project.source.files) {
+      const parsed = parsedFile(ts, ctx.project.source, file)
       if (parsed === undefined) continue
       const { tree, lines } = parsed
       const visit = (node: TSApi.Node): void => {
@@ -284,8 +284,8 @@ export const corsOriginPredicateRule: CheckRule = {
     const ts = await importProjectTypeScript(ctx.root)
     if (ts === undefined) return didNotRun("NF-S004", "CORS origin predicate scan")
     const findings: Diagnostic[] = []
-    for (const file of ctx.sources.files) {
-      const parsed = parsedFile(ts, ctx.sources, file)
+    for (const file of ctx.project.source.files) {
+      const parsed = parsedFile(ts, ctx.project.source, file)
       if (parsed === undefined) continue
       const { tree, lines } = parsed
       const visit = (node: TSApi.Node): void => {
@@ -345,8 +345,8 @@ export const externalRedirectRule: CheckRule = {
     const ts = await importProjectTypeScript(ctx.root)
     if (ts === undefined) return didNotRun("NF-S005", "External redirect opt-out scan")
     const findings: Diagnostic[] = []
-    for (const file of ctx.sources.files) {
-      const parsed = parsedFile(ts, ctx.sources, file)
+    for (const file of ctx.project.source.files) {
+      const parsed = parsedFile(ts, ctx.project.source, file)
       if (parsed === undefined) continue
       const { tree, lines } = parsed
       const visit = (node: TSApi.Node): void => {
@@ -402,8 +402,8 @@ export const assuranceEscapeHatchRule: CheckRule = {
     const ts = await importProjectTypeScript(ctx.root)
     if (ts === undefined) return didNotRun("NF-S006", "Security escape hatch scan")
     const findings: Diagnostic[] = []
-    for (const file of ctx.sources.files) {
-      const parsed = parsedFile(ts, ctx.sources, file)
+    for (const file of ctx.project.source.files) {
+      const parsed = parsedFile(ts, ctx.project.source, file)
       if (parsed === undefined) continue
       const { tree, lines } = parsed
       const visit = (node: TSApi.Node): void => {
@@ -445,8 +445,8 @@ export const unprefixedSecureCookieRule: CheckRule = {
     const ts = await importProjectTypeScript(ctx.root)
     if (ts === undefined) return didNotRun("NF-S007", "Secure cookie prefix scan")
     const findings: Diagnostic[] = []
-    for (const file of ctx.sources.files) {
-      const parsed = parsedFile(ts, ctx.sources, file)
+    for (const file of ctx.project.source.files) {
+      const parsed = parsedFile(ts, ctx.project.source, file)
       if (parsed === undefined) continue
       const { tree } = parsed
       const visit = (node: TSApi.Node): void => {