@noctcore/lint-meta-rules 0.3.0 → 0.4.1

package/README.md

@@ -81,3 +81,25 @@ they are inert until you point them at your catalogs.
 | Factory | Category | What it enforces |
 | --- | --- | --- |
 | [`createTranslationDeadKeysRule`](./docs/rules/translation-dead-keys.md) | source-text | Every catalog key is reachable: named by a translation call, or spelled by some string in the source. |
+
+### `@noctcore/lint-meta-rules/resolved-config`
+
+Checks over the RESOLVED ESLint config. They load ESLint and resolve configs through
+`calculateConfigForFile`, which is async, so they implement the harness's `runAsync`
+(`@noctcore/harness` 0.3.0 or newer) and need the optional peer `eslint`.
+
+| Factory | Category | What it enforces |
+| --- | --- | --- |
+| [`createEslintConfigNoWarnRule`](./docs/rules/eslint-config-no-warn.md) | config | No rule RESOLVES to `warn`, including a severity a spread preset injects, which the text scan of `no-warn-severity` cannot see. |
+
+### `@noctcore/lint-meta-rules/prisma`
+
+Whole-repo Prisma guardrails that keep `@noctcore/eslint-plugin-prisma`'s inputs honest. They read
+the plugin's method sets, schema parser and registry reconciliation, so the lint rules and these
+checks cannot disagree. The registry parity check resolves an ESLint config (async, `runAsync`) and
+needs the optional peer `eslint`. Neither is in `RULE_FACTORIES`: both need the project's paths.
+
+| Factory | Category | What it enforces |
+| --- | --- | --- |
+| [`createTenantModelRegistryParityRule`](./docs/rules/tenant-model-registry-parity.md) | config | Every tenant-bearing schema model is scoped at runtime or exempt with a reason, and the tenant lint rules resolve with exactly that registry. |
+| [`createPrismaMethodSurfaceRule`](./docs/rules/prisma-method-surface.md) | config | The reads and writes the rules police are exactly the generated client's delegate methods, so a Prisma upgrade cannot add an unguarded one. |

package/dist/chunk-VFCX3QKZ.js

@@ -0,0 +1,47 @@
+// src/resolved-config/resolve.ts
+import { realpathSync } from "fs";
+import path from "path";
+import { ESLint } from "eslint";
+function severityOf(entry) {
+  const raw = Array.isArray(entry) ? entry[0] : entry;
+  if (raw === 1 || raw === "warn") return 1;
+  if (raw === 2 || raw === "error") return 2;
+  return 0;
+}
+function firstOptionOf(entry) {
+  if (!Array.isArray(entry)) return null;
+  const options = entry[1];
+  return typeof options === "object" && options !== null && !Array.isArray(options) ? options : null;
+}
+async function resolveRules(root, packageDir, probes) {
+  let cwd = path.resolve(root, packageDir);
+  try {
+    cwd = realpathSync(cwd);
+  } catch (error) {
+    return { ok: false, error: String(error) };
+  }
+  const eslint = new ESLint({ cwd, errorOnUnmatchedPattern: false });
+  const rules = [];
+  const ignored = [];
+  for (const probe of probes) {
+    let config;
+    try {
+      config = await eslint.calculateConfigForFile(path.join(cwd, probe));
+    } catch (error) {
+      return { ok: false, error: `resolving "${probe}": ${String(error)}` };
+    }
+    if (config === void 0) ignored.push(probe);
+    else rules.push(config.rules ?? {});
+  }
+  if (rules.length > 0) return { ok: true, rules };
+  return {
+    ok: false,
+    error: probes.length === 0 ? "no probe files are configured" : `every probe (${ignored.map((probe) => `"${probe}"`).join(", ")}) is ignored by the config or matched by no block`
+  };
+}
+
+export {
+  severityOf,
+  firstOptionOf,
+  resolveRules
+};

package/dist/prisma.cjs

@@ -0,0 +1,442 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/prisma.ts
+var prisma_exports = {};
+__export(prisma_exports, {
+  createPrismaMethodSurfaceRule: () => createPrismaMethodSurfaceRule,
+  createTenantModelRegistryParityRule: () => createTenantModelRegistryParityRule,
+  parseDelegateSurfaces: () => parseDelegateSurfaces,
+  parseObjectLiteralKeys: () => parseObjectLiteralKeys
+});
+module.exports = __toCommonJS(prisma_exports);
+
+// src/prisma/prisma-method-surface.ts
+var import_eslint_plugin_prisma = require("@noctcore/eslint-plugin-prisma");
+
+// src/rules/shared.ts
+function globFiles(glob, globs, skipDirs = []) {
+  const skip = new Set(skipDirs);
+  const found = /* @__PURE__ */ new Set();
+  for (const pattern of globs) {
+    for (const rel of glob(pattern)) {
+      if (!rel.split("/").some((segment) => skip.has(segment))) found.add(rel);
+    }
+  }
+  return [...found].sort();
+}
+
+// src/prisma/prisma-method-surface.ts
+var DEFAULT_ID = "prisma-method-surface";
+var DEFAULT_CLIENT_GLOBS = [
+  "generated/prisma/models/*.ts",
+  "node_modules/.prisma/client/index.d.ts"
+];
+function blankComments(source) {
+  return source.replace(/\/\*[\s\S]*?\*\//gu, (comment) => comment.replace(/[^\n]/gu, " ")).replace(/(^|[^:])\/\/.*$/gmu, "$1");
+}
+function parseDelegateSurfaces(source, file = "") {
+  const lines = blankComments(source).split("\n");
+  const surfaces = [];
+  for (let i = 0; i < lines.length; i += 1) {
+    const open = /^(\s*)(?:export\s+)?interface\s+([A-Za-z_]\w*)Delegate\b.*\{\s*$/u.exec(
+      lines[i] ?? ""
+    );
+    if (open?.[2] === void 0) continue;
+    const indent = open[1] ?? "";
+    let memberIndent = null;
+    const methods = /* @__PURE__ */ new Set();
+    let j = i + 1;
+    for (; j < lines.length; j += 1) {
+      const line = lines[j] ?? "";
+      if (line.startsWith(`${indent}}`)) break;
+      if (line.trim() === "") continue;
+      const leading = /^\s*/u.exec(line)?.[0] ?? "";
+      memberIndent ??= leading;
+      if (leading !== memberIndent) continue;
+      const member = /^\s*([A-Za-z_]\w*)\s*</u.exec(line);
+      if (member?.[1] !== void 0) methods.add(member[1]);
+    }
+    surfaces.push({ file, model: open[2], methods: [...methods].sort() });
+    i = j;
+  }
+  return surfaces;
+}
+var sorted = (values) => [...values].sort();
+function createPrismaMethodSurfaceRule(options = {}) {
+  const id = options.id ?? DEFAULT_ID;
+  const clientGlobs = options.clientGlobs ?? DEFAULT_CLIENT_GLOBS;
+  const writeMethods = options.writeMethods ?? import_eslint_plugin_prisma.PRISMA_WRITE_METHODS;
+  const readMethods = options.readMethods ?? import_eslint_plugin_prisma.PRISMA_READ_METHODS;
+  return {
+    id,
+    category: "config",
+    ciCritical: options.ciCritical ?? true,
+    description: "The Prisma reads and writes the rules police partition the generated client's <Model>Delegate method surface exactly, so a Prisma upgrade cannot add an unguarded method.",
+    run(ctx) {
+      const violations = [];
+      const report = (file, message) => {
+        violations.push({ file, rule: id, message });
+      };
+      const listFile = clientGlobs[0] ?? "<clientGlobs>";
+      const writes = new Set(writeMethods);
+      for (const method of readMethods) {
+        if (writes.has(method)) {
+          report(listFile, `"${method}" is configured as both a read and a write. Each delegate method belongs to exactly one.`);
+        }
+      }
+      const surfaces = globFiles((pattern) => ctx.glob(pattern), clientGlobs).flatMap(
+        (file) => parseDelegateSurfaces(ctx.read(file) ?? "", file)
+      ).filter((surface) => surface.methods.length > 0);
+      const [reference] = surfaces;
+      if (reference === void 0) {
+        report(
+          listFile,
+          `No generated Prisma client found under ${clientGlobs.map((glob) => `"${glob}"`).join(", ")}, so the method surface cannot be checked. Run \`prisma generate\` before lint-meta, or point \`clientGlobs\` at the generator's output.`
+        );
+        return violations;
+      }
+      const referenceKey = reference.methods.join(",");
+      for (const surface of surfaces) {
+        if (surface.methods.join(",") !== referenceKey) {
+          report(
+            surface.file,
+            `${surface.model}Delegate exposes [${surface.methods.join(", ")}], which differs from ${reference.model}Delegate's [${reference.methods.join(", ")}]. The method lists are model-agnostic, so they cannot describe both.`
+          );
+        }
+      }
+      const configured = /* @__PURE__ */ new Set([...writeMethods, ...readMethods]);
+      const actual = new Set(reference.methods);
+      const unguarded = sorted(reference.methods.filter((method) => !configured.has(method)));
+      const phantom = sorted([...configured].filter((method) => !actual.has(method)));
+      if (unguarded.length > 0) {
+        report(
+          reference.file,
+          `The generated client exposes ${unguarded.map((m) => `"${m}"`).join(", ")}, which is neither a configured read nor a configured write, so every rule guarding Prisma calls by method name misses it. Classify it in \`writeMethods\` or \`readMethods\` (and in the rules that read those lists).`
+        );
+      }
+      if (phantom.length > 0) {
+        report(
+          reference.file,
+          `${phantom.map((m) => `"${m}"`).join(", ")} is configured but the generated client no longer exposes it. Drop it from the lists, or check the client was regenerated for this Prisma version.`
+        );
+      }
+      return violations;
+    }
+  };
+}
+
+// src/prisma/tenant-model-registry-parity.ts
+var import_eslint_plugin_prisma2 = require("@noctcore/eslint-plugin-prisma");
+
+// src/resolved-config/resolve.ts
+var import_node_fs = require("fs");
+var import_node_path = __toESM(require("path"), 1);
+var import_eslint = require("eslint");
+function severityOf(entry) {
+  const raw = Array.isArray(entry) ? entry[0] : entry;
+  if (raw === 1 || raw === "warn") return 1;
+  if (raw === 2 || raw === "error") return 2;
+  return 0;
+}
+function firstOptionOf(entry) {
+  if (!Array.isArray(entry)) return null;
+  const options = entry[1];
+  return typeof options === "object" && options !== null && !Array.isArray(options) ? options : null;
+}
+async function resolveRules(root, packageDir, probes) {
+  let cwd = import_node_path.default.resolve(root, packageDir);
+  try {
+    cwd = (0, import_node_fs.realpathSync)(cwd);
+  } catch (error) {
+    return { ok: false, error: String(error) };
+  }
+  const eslint = new import_eslint.ESLint({ cwd, errorOnUnmatchedPattern: false });
+  const rules = [];
+  const ignored = [];
+  for (const probe of probes) {
+    let config;
+    try {
+      config = await eslint.calculateConfigForFile(import_node_path.default.join(cwd, probe));
+    } catch (error) {
+      return { ok: false, error: `resolving "${probe}": ${String(error)}` };
+    }
+    if (config === void 0) ignored.push(probe);
+    else rules.push(config.rules ?? {});
+  }
+  if (rules.length > 0) return { ok: true, rules };
+  return {
+    ok: false,
+    error: probes.length === 0 ? "no probe files are configured" : `every probe (${ignored.map((probe) => `"${probe}"`).join(", ")}) is ignored by the config or matched by no block`
+  };
+}
+
+// src/prisma/tenant-model-registry-parity.ts
+var DEFAULT_ID2 = "tenant-model-registry-parity";
+var DEFAULT_SCHEMA_PATH = "prisma/schema.prisma";
+var DEFAULT_TENANT_FIELDS = ["tenantId"];
+var DEFAULT_PROBE = "src/__lint_meta_probe__.ts";
+var DEFAULT_MODEL_RULES = [
+  "noctcore-prisma/no-cross-tenant-id-in-where",
+  "noctcore-prisma/tenant-scoped-tables-require-where",
+  "noctcore-prisma/tenant-write-must-carry-tenant-id"
+];
+var DEFAULT_HAND_SCOPED_RULE = "noctcore-prisma/tenant-scoped-tables-require-where";
+function blankCommentsAndStrings(source) {
+  const out = source.split("");
+  let i = 0;
+  while (i < source.length) {
+    const two = source.slice(i, i + 2);
+    if (two === "//") {
+      while (i < source.length && source[i] !== "\n") out[i++] = " ";
+      continue;
+    }
+    if (two === "/*") {
+      const end = source.indexOf("*/", i + 2);
+      const stop = end === -1 ? source.length : end + 2;
+      for (; i < stop; i += 1) if (source[i] !== "\n") out[i] = " ";
+      continue;
+    }
+    const quote = source[i];
+    if (quote === "'" || quote === '"' || quote === "`") {
+      i += 1;
+      while (i < source.length && source[i] !== quote) {
+        if (source[i] === "\\") out[i++] = " ";
+        if (i < source.length && source[i] !== "\n") out[i] = " ";
+        i += 1;
+      }
+      i += 1;
+      continue;
+    }
+    i += 1;
+  }
+  return out.join("");
+}
+var OPENERS = /* @__PURE__ */ new Set(["{", "[", "("]);
+var CLOSERS = /* @__PURE__ */ new Set(["}", "]", ")"]);
+function parseObjectLiteralKeys(source, exportName) {
+  const blanked = blankCommentsAndStrings(source);
+  const escaped = exportName.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+  const declaration = new RegExp(`\\b${escaped}\\s*(?::[^=]+)?=\\s*\\{`, "u").exec(blanked);
+  if (declaration === null) return null;
+  const open = declaration.index + declaration[0].length - 1;
+  const keys = [];
+  let depth = 0;
+  let token = "";
+  for (let i = open; i < blanked.length; i += 1) {
+    const char = blanked[i] ?? "";
+    if (OPENERS.has(char)) {
+      depth += 1;
+      token = "";
+    } else if (CLOSERS.has(char)) {
+      depth -= 1;
+      token = "";
+      if (depth === 0) return keys;
+    } else if (depth === 1 && char === ":") {
+      const key = token.trim();
+      if (/^[A-Za-z_$][\w$]*$/u.test(key)) keys.push(key);
+      token = "";
+    } else if (depth === 1 && char === ",") {
+      token = "";
+    } else if (depth === 1) {
+      token += char;
+    }
+  }
+  return null;
+}
+function readSchema(ctx, schemaPath) {
+  const base = schemaPath.replace(/\/+$/u, "");
+  const files = ctx.glob(`${base}/**/*.prisma`).sort();
+  const texts = files.length > 0 ? files.map((file) => ctx.read(file) ?? "") : [ctx.read(base)];
+  if (texts.some((text) => text === null)) return null;
+  const parsed = (0, import_eslint_plugin_prisma2.parsePrismaSchema)(texts.join("\n"));
+  return parsed.models.length > 0 ? parsed : null;
+}
+function fingerprint(models) {
+  return Object.keys(models).sort().map((model) => `${model}:${[...models[model] ?? []].sort().join("+")}`).join(",");
+}
+function handScopeMessages(registry) {
+  const unscoped = registry.unscopedByDesign;
+  const handScoped = registry.handScopedModels ?? {};
+  const pending = registry.handScopePending ?? {};
+  const messages = [];
+  for (const model of Object.keys(unscoped)) {
+    if (Object.hasOwn(handScoped, model) || Object.hasOwn(pending, model)) continue;
+    messages.push(
+      `\`${model}\` is exempt from the tenant-scope extension but has no \`handScopedModels\` entry, so "scoped by hand" is enforced by nothing. List the column(s) every query on it must filter by, or record why it cannot have one in \`handScopePending\`.`
+    );
+  }
+  for (const model of Object.keys(handScoped)) {
+    if (!Object.hasOwn(unscoped, model)) {
+      messages.push(
+        `\`${model}\` has a \`handScopedModels\` entry but is not exempt from the extension, so the static guard polices a model the runtime boundary already scopes. Drop the entry, or add the exemption it belongs to.`
+      );
+    }
+  }
+  for (const model of Object.keys(pending)) {
+    if (!Object.hasOwn(unscoped, model)) {
+      messages.push(
+        `\`${model}\` is recorded in \`handScopePending\` but is not exempt from the extension any more. The note is stale: delete it.`
+      );
+    }
+  }
+  return messages;
+}
+function createTenantModelRegistryParityRule(options = {}) {
+  const id = options.id ?? DEFAULT_ID2;
+  const schemaPath = options.schemaPath ?? DEFAULT_SCHEMA_PATH;
+  const tenantFields = options.tenantFields ?? DEFAULT_TENANT_FIELDS;
+  const registry = options.registry ?? { scopedModels: [], unscopedByDesign: {} };
+  const source = options.scopedModelsSource;
+  const registryFile = options.registryFile ?? source?.file ?? schemaPath;
+  const requireHandScope = options.requireHandScope ?? true;
+  const eslint = options.eslint === false ? null : options.eslint ?? {};
+  return {
+    id,
+    category: "config",
+    ciCritical: options.ciCritical ?? true,
+    description: "Every tenant-bearing Prisma model is scoped by the runtime extension or exempt with a reason, and the tenant lint rules resolve with exactly that registry.",
+    async runAsync(ctx) {
+      const violations = [];
+      const report = (file, message) => {
+        violations.push({ file, rule: id, message });
+      };
+      let scopedModels = registry.scopedModels;
+      if (source !== void 0) {
+        const text = ctx.read(source.file);
+        const keys = text === null ? null : parseObjectLiteralKeys(text, source.exportName);
+        if (keys === null || keys.length === 0) {
+          report(
+            source.file,
+            `Could not read the \`${source.exportName}\` object literal in ${source.file}, so the runtime scope map cannot be checked. The rule expects \`const ${source.exportName} = { model: ..., ... }\`; if the declaration moved or changed shape, update \`scopedModelsSource\` rather than dropping the check.`
+          );
+          return violations;
+        }
+        scopedModels = keys;
+      }
+      if (requireHandScope) {
+        for (const message of handScopeMessages(registry)) report(registryFile, message);
+      }
+      const parsed = readSchema(ctx, schemaPath);
+      if (parsed === null) {
+        report(
+          schemaPath,
+          `Could not read a Prisma schema with any model at "${schemaPath}", so tenant-bearing models cannot be derived. Point \`schemaPath\` at the schema file or folder rather than dropping the check.`
+        );
+      } else {
+        for (const message of (0, import_eslint_plugin_prisma2.reconcileTenantRegistry)({
+          parsed,
+          tenantFields,
+          scopedModels,
+          unscopedByDesign: registry.unscopedByDesign
+        }).messages) {
+          report(source?.file ?? registryFile, message);
+        }
+      }
+      if (eslint === null) return violations;
+      const cwd = eslint.cwd ?? ".";
+      const configFile = eslint.configFile ?? cwd;
+      const modelsOption = eslint.modelsOption ?? "tenantModels";
+      const handScopedOption = eslint.handScopedOption ?? "handScopedModels";
+      const handScopedRule = eslint.handScopedRule === void 0 ? DEFAULT_HAND_SCOPED_RULE : eslint.handScopedRule;
+      const outcome = await resolveRules(ctx.root, cwd, [eslint.probe ?? DEFAULT_PROBE]);
+      if (!outcome.ok) {
+        report(
+          configFile,
+          `Could not resolve the effective ESLint config for "${cwd}", so the tenant rules' registry cannot be checked (if it imports a workspace package, build that first): ${outcome.error}`
+        );
+        return violations;
+      }
+      const rules = outcome.rules[0] ?? {};
+      const scopedSet = new Set(scopedModels);
+      for (const ruleId of eslint.modelRules ?? DEFAULT_MODEL_RULES) {
+        const entry = rules[ruleId];
+        const raw = firstOptionOf(entry)?.[modelsOption];
+        if (severityOf(entry) === 0) {
+          report(
+            configFile,
+            `"${ruleId}" is off (or not configured) for "${cwd}", so nothing statically polices the ${String(scopedModels.length)} tenant-scoped model(s). Enable it with \`${modelsOption}\` set to the scoped models.`
+          );
+          continue;
+        }
+        if (!Array.isArray(raw) || !raw.every((model) => typeof model === "string")) {
+          report(
+            configFile,
+            `"${ruleId}" resolves with no \`${modelsOption}\` option for "${cwd}", so it falls back to its default and does not police the ${String(scopedModels.length)} tenant-scoped model(s). Pass the scoped models to it.`
+          );
+          continue;
+        }
+        const configured = new Set(raw);
+        for (const model of scopedModels) {
+          if (!configured.has(model)) {
+            report(
+              configFile,
+              `\`${model}\` is tenant-scoped at runtime but is MISSING from the \`${modelsOption}\` option of "${ruleId}", so no static rule polices it. Add it to the list the config passes.`
+            );
+          }
+        }
+        for (const model of configured) {
+          if (!scopedSet.has(model)) {
+            report(
+              configFile,
+              `\`${model}\` is in the \`${modelsOption}\` option of "${ruleId}" but is not tenant-scoped at runtime, so lint guards a model the runtime boundary does not isolate. Scope it at runtime, or drop it from the list the config passes.`
+            );
+          }
+        }
+      }
+      const expectedHandScoped = registry.handScopedModels ?? {};
+      if (handScopedRule !== null && Object.keys(expectedHandScoped).length > 0) {
+        const raw = firstOptionOf(rules[handScopedRule])?.[handScopedOption];
+        if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+          report(
+            configFile,
+            `"${handScopedRule}" resolves with no \`${handScopedOption}\` option for "${cwd}", so the models the extension does NOT scope (${Object.keys(expectedHandScoped).sort().join(", ")}) are policed by nothing. Pass the registry's hand-scope map to it.`
+          );
+        } else {
+          const resolved = fingerprint(raw);
+          const expected = fingerprint(expectedHandScoped);
+          if (resolved !== expected) {
+            report(
+              configFile,
+              `The \`${handScopedOption}\` option "${handScopedRule}" resolves to does not match the registry (resolved: ${resolved}; expected: ${expected}). Pass the registry map itself rather than a hand-written copy.`
+            );
+          }
+        }
+      }
+      return violations;
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createPrismaMethodSurfaceRule,
+  createTenantModelRegistryParityRule,
+  parseDelegateSurfaces,
+  parseObjectLiteralKeys
+});