@pikku/inspector 0.12.41 → 0.12.43

package/src/utils/nested-project-filter.test.ts

@@ -0,0 +1,53 @@
+import { test } from 'node:test'
+import * as assert from 'node:assert'
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'fs'
+import { tmpdir } from 'os'
+import { join } from 'path'
+import { createNestedProjectFilter } from './nested-project-filter.js'
+
+test('createNestedProjectFilter', async (t) => {
+  const root = mkdtempSync(join(tmpdir(), 'pikku-nested-'))
+  t.after(() => rmSync(root, { recursive: true, force: true }))
+
+  writeFileSync(join(root, 'pikku.config.json'), '{}')
+  mkdirSync(join(root, 'packages/functions/src'), { recursive: true })
+  mkdirSync(join(root, 'packages/addon/src'), { recursive: true })
+  mkdirSync(join(root, 'packages/addon/types'), { recursive: true })
+  writeFileSync(join(root, 'packages/addon/pikku.config.json'), '{}')
+
+  const isNested = createNestedProjectFilter(root)
+
+  await t.test('keeps project source files', () => {
+    assert.strictEqual(
+      isNested(join(root, 'packages/functions/src/auth.ts')),
+      false
+    )
+  })
+
+  await t.test('keeps files directly under rootDir', () => {
+    assert.strictEqual(isNested(join(root, 'services.ts')), false)
+  })
+
+  await t.test('excludes files inside a nested pikku project', () => {
+    assert.strictEqual(
+      isNested(join(root, 'packages/addon/types/application-types.d.ts')),
+      true
+    )
+    assert.strictEqual(
+      isNested(join(root, 'packages/addon/src/index.ts')),
+      true
+    )
+  })
+
+  await t.test('keeps files outside rootDir untouched', () => {
+    assert.strictEqual(isNested('/somewhere/else/file.ts'), false)
+  })
+
+  await t.test('rootDir itself is not treated as nested', () => {
+    const addonScoped = createNestedProjectFilter(join(root, 'packages/addon'))
+    assert.strictEqual(
+      addonScoped(join(root, 'packages/addon/src/index.ts')),
+      false
+    )
+  })
+})

package/src/utils/nested-project-filter.ts

@@ -0,0 +1,28 @@
+import { existsSync } from 'fs'
+import { dirname, join } from 'path'
+
+export const createNestedProjectFilter = (rootDir: string) => {
+  const cache = new Map<string, boolean>()
+  return (fileName: string): boolean => {
+    const pending: string[] = []
+    let dir = dirname(fileName)
+    let nested = false
+    while (dir.startsWith(rootDir) && dir !== rootDir) {
+      const cached = cache.get(dir)
+      if (cached !== undefined) {
+        nested = cached
+        break
+      }
+      pending.push(dir)
+      if (existsSync(join(dir, 'pikku.config.json'))) {
+        nested = true
+        break
+      }
+      const parent = dirname(dir)
+      if (parent === dir) break
+      dir = parent
+    }
+    for (const d of pending) cache.set(d, nested)
+    return nested
+  }
+}

package/src/utils/permissions.test.ts

@@ -1,193 +1,10 @@
 import { describe, test } from 'node:test'
 import assert from 'node:assert'
-import {
-  routeMatchesPattern,
-  resolveHTTPPermissions,
-  resolvePermissions,
-} from './permissions.js'
-import type { InspectorState, PermissionGroupMeta } from '../types.js'
-
-describe('routeMatchesPattern', () => {
-  test('should match exact routes', () => {
-    assert.strictEqual(routeMatchesPattern('/api/users', '/api/users'), true)
-  })
-
-  test('should not match different routes', () => {
-    assert.strictEqual(routeMatchesPattern('/api/users', '/api/posts'), false)
-  })
-
-  test('should match wildcard patterns', () => {
-    assert.strictEqual(routeMatchesPattern('/api/users', '/api/*'), true)
-    assert.strictEqual(routeMatchesPattern('/api/users/123', '/api/*'), true)
-    assert.strictEqual(routeMatchesPattern('/api/posts', '/api/*'), true)
-  })
-
-  test('should match global wildcard', () => {
-    assert.strictEqual(routeMatchesPattern('/api/users', '*'), true)
-    assert.strictEqual(routeMatchesPattern('/any/path', '*'), true)
-  })
-
-  test('should not match if pattern is more specific', () => {
-    assert.strictEqual(routeMatchesPattern('/users', '/api/*'), false)
-  })
-})
-
-describe('resolveHTTPPermissions', () => {
-  test('should return undefined when no permissions exist', () => {
-    const state: InspectorState = createMockState()
-
-    const result = resolveHTTPPermissions(
-      state,
-      '/api/test',
-      undefined,
-      undefined,
-      {} as any
-    )
-
-    assert.strictEqual(result, undefined)
-  })
-
-  test('should resolve global HTTP permissions', () => {
-    const state: InspectorState = createMockState()
-    const globalPermission: PermissionGroupMeta = {
-      exportName: 'globalPermissions',
-      sourceFile: '/test.ts',
-      position: 0,
-      services: { services: [], singletons: [] },
-      count: 1,
-      instanceIds: [],
-      isFactory: true,
-    }
-    state.http.routePermissions.set('*', globalPermission)
-
-    const result = resolveHTTPPermissions(
-      state,
-      '/api/test',
-      undefined,
-      undefined,
-      {} as any
-    )
-
-    assert.ok(result)
-    assert.strictEqual(result.length, 1)
-    assert.deepEqual(result[0], { type: 'http', route: '*' })
-  })
-
-  test('should resolve route pattern permissions', () => {
-    const state: InspectorState = createMockState()
-    const apiPermission: PermissionGroupMeta = {
-      exportName: 'apiPermissions',
-      sourceFile: '/test.ts',
-      position: 0,
-      services: { services: [], singletons: [] },
-      count: 1,
-      instanceIds: [],
-      isFactory: true,
-    }
-    state.http.routePermissions.set('/api/*', apiPermission)
-
-    const result = resolveHTTPPermissions(
-      state,
-      '/api/users',
-      undefined,
-      undefined,
-      {} as any
-    )
-
-    assert.ok(result)
-    assert.strictEqual(result.length, 1)
-    assert.deepEqual(result[0], { type: 'http', route: '/api/*' })
-  })
-
-  test('should resolve tag-based permissions', () => {
-    const state: InspectorState = createMockState()
-    const adminPermission: PermissionGroupMeta = {
-      exportName: 'adminPermissions',
-      sourceFile: '/test.ts',
-      position: 0,
-      services: { services: [], singletons: [] },
-      count: 1,
-      instanceIds: [],
-      isFactory: true,
-    }
-    state.permissions.tagPermissions.set('admin', adminPermission)
-
-    const result = resolveHTTPPermissions(
-      state,
-      '/api/admin',
-      ['admin'],
-      undefined,
-      {} as any
-    )
-
-    assert.ok(result)
-    assert.strictEqual(result.length, 1)
-    assert.deepEqual(result[0], { type: 'tag', tag: 'admin' })
-  })
-
-  test('should combine multiple permission sources in correct order', () => {
-    const state: InspectorState = createMockState()
-
-    // Setup global HTTP permission
-    state.http.routePermissions.set('*', {
-      exportName: 'global',
-      sourceFile: '/test.ts',
-      position: 0,
-      services: { services: [], singletons: [] },
-      count: 1,
-      instanceIds: [],
-      isFactory: true,
-    })
-
-    // Setup route pattern permission
-    state.http.routePermissions.set('/api/*', {
-      exportName: 'apiRoute',
-      sourceFile: '/test.ts',
-      position: 0,
-      services: { services: [], singletons: [] },
-      count: 1,
-      instanceIds: [],
-      isFactory: true,
-    })
-
-    // Setup tag permission
-    state.permissions.tagPermissions.set('admin', {
-      exportName: 'adminTag',
-      sourceFile: '/test.ts',
-      position: 0,
-      services: { services: [], singletons: [] },
-      count: 1,
-      instanceIds: [],
-      isFactory: true,
-    })
-
-    // Setup explicit permission
-    state.permissions.definitions['testPermission'] = {
-      services: { services: [], singletons: [] },
-      sourceFile: '/test.ts',
-      position: 0,
-      exportedName: 'testPerm',
-    }
-
-    const result = resolveHTTPPermissions(
-      state,
-      '/api/admin',
-      ['admin'],
-      undefined, // We'd need a real TS node for this
-      {} as any
-    )
-
-    assert.ok(result)
-    // Should have: global HTTP, route pattern, tag
-    assert.strictEqual(result.length, 3)
-    assert.deepEqual(result[0], { type: 'http', route: '*' })
-    assert.deepEqual(result[1], { type: 'http', route: '/api/*' })
-    assert.deepEqual(result[2], { type: 'tag', tag: 'admin' })
-  })
-})
+import { resolvePermissions } from './permissions.js'
+import type { InspectorState } from '../types.js'
 
 describe('resolvePermissions', () => {
-  test('should return undefined when no permissions exist', () => {
+  test('should return undefined when the object declares no permissions', () => {
     const state: InspectorState = createMockState()
     const mockObj = createMockObjectLiteral()
 
@@ -196,47 +13,10 @@ describe('resolvePermissions', () => {
     assert.strictEqual(result, undefined)
   })
 
-  test('should resolve tag-based permissions', () => {
-    const state: InspectorState = createMockState()
-    const mcpPermission: PermissionGroupMeta = {
-      exportName: 'mcpPermissions',
-      sourceFile: '/test.ts',
-      position: 0,
-      services: { services: [], singletons: [] },
-      count: 1,
-      instanceIds: [],
-      isFactory: true,
-    }
-    state.permissions.tagPermissions.set('mcp', mcpPermission)
-    const mockObj = createMockObjectLiteral()
-
-    const result = resolvePermissions(state, mockObj, ['mcp'], {} as any)
-
-    assert.ok(result)
-    assert.strictEqual(result.length, 1)
-    assert.deepEqual(result[0], { type: 'tag', tag: 'mcp' })
-  })
-
-  test('should handle multiple tags', () => {
+  test('tags no longer resolve to permissions', () => {
+    // Permissions are function-scoped only; tags are organizational and never
+    // contribute permission metadata.
     const state: InspectorState = createMockState()
-    state.permissions.tagPermissions.set('mcp', {
-      exportName: 'mcpPerms',
-      sourceFile: '/test.ts',
-      position: 0,
-      services: { services: [], singletons: [] },
-      count: 1,
-      instanceIds: [],
-      isFactory: true,
-    })
-    state.permissions.tagPermissions.set('admin', {
-      exportName: 'adminPerms',
-      sourceFile: '/test.ts',
-      position: 0,
-      services: { services: [], singletons: [] },
-      count: 1,
-      instanceIds: [],
-      isFactory: true,
-    })
     const mockObj = createMockObjectLiteral()
 
     const result = resolvePermissions(
@@ -246,10 +26,7 @@ describe('resolvePermissions', () => {
       {} as any
     )
 
-    assert.ok(result)
-    assert.strictEqual(result.length, 2)
-    assert.deepEqual(result[0], { type: 'tag', tag: 'mcp' })
-    assert.deepEqual(result[1], { type: 'tag', tag: 'admin' })
+    assert.strictEqual(result, undefined)
   })
 })
 
@@ -288,7 +65,6 @@ function createMockState(): InspectorState {
       },
       files: new Set(),
       routeMiddleware: new Map(),
-      routePermissions: new Map(),
     },
     functions: {
       typesMap: {} as any,
@@ -344,7 +120,6 @@ function createMockState(): InspectorState {
     permissions: {
       definitions: {},
       instances: {},
-      tagPermissions: new Map(),
     },
   }
 }

package/src/utils/permissions.ts

@@ -76,147 +76,34 @@ export function getPermissionsNode(
 }
 
 /**
- * Check if a route matches a pattern with wildcards
- * Pattern can be exact match or use * as wildcard
- * e.g., '/api/*' matches '/api/users', '/api/posts/123', etc.
+ * Resolve the explicit permission references declared on a function (or agent).
+ * Permissions are function-scoped only: a `permissions: { group: [fn] }` object
+ * is flattened to `{ type: 'wire', name }` references used at filter time.
+ * Returns undefined if none are declared, otherwise an array with ≥1 item.
  */
-export function routeMatchesPattern(route: string, pattern: string): boolean {
-  if (route === pattern) return true
-
-  // Convert pattern to regex: replace * with .*
-  const regexPattern = pattern
-    .replace(/[.+?^${}()|[\]\\]/g, '\\$&') // Escape regex special chars except *
-    .replace(/\*/g, '.*') // Replace * with .*
-
-  const regex = new RegExp(`^${regexPattern}$`)
-  return regex.test(route)
-}
-
-/**
- * Resolve permissions for an HTTP wiring based on:
- * 1. Global HTTP permissions (addHTTPPermission('*', [...]))
- * 2. Route-specific HTTP permissions (addHTTPPermission('/pattern', [...]))
- * 3. Tag-based permissions (addPermission('tag', [...]))
- * 4. Explicit wiring permissions (wireHTTP({ permissions: [...] }))
- * Returns undefined if no permissions are found, otherwise returns array with at least one item
- */
-export function resolveHTTPPermissions(
+function resolveExplicitPermissions(
   state: InspectorState,
-  route: string,
-  tags: string[] | undefined,
   explicitPermissionsNode: ts.Expression | undefined,
   checker: ts.TypeChecker
 ): PermissionMetadata[] | undefined {
-  const resolved: PermissionMetadata[] = []
-
-  // 1. HTTP route permission groups (includes '*' for global)
-  for (const [pattern, _groupMeta] of state.http.routePermissions.entries()) {
-    if (routeMatchesPattern(route, pattern)) {
-      // Just reference the group by route pattern
-      resolved.push({
-        type: 'http',
-        route: pattern,
-      })
-    }
+  if (!explicitPermissionsNode) {
+    return undefined
   }
 
-  // 2. Tag-based permission groups
-  if (tags && tags.length > 0) {
-    for (const tag of tags) {
-      if (state.permissions.tagPermissions.has(tag)) {
-        // Just reference the group by tag
-        resolved.push({
-          type: 'tag',
-          tag,
-        })
-      }
-    }
-  }
-
-  // 3. Explicit wire permissions (inline is OK here)
-  if (explicitPermissionsNode) {
-    const permissionNames = extractPermissionPikkuNames(
-      explicitPermissionsNode,
-      checker,
-      state.rootDir
-    )
-    for (const name of permissionNames) {
-      const def = state.permissions.definitions[name]
-      resolved.push({
-        type: 'wire',
-        name,
-        inline: def?.exportedName === null,
-      })
-    }
-  }
-
-  return resolved.length > 0 ? resolved : undefined
-}
-
-/**
- * Resolve tag-based and explicit permissions (common logic for wires and functions)
- * 1. Tag-based permissions (addPermission('tag', [...]))
- * 2. Explicit permissions (wireHTTP/pikkuFunc({ permissions: [...] }))
- */
-function resolveTagAndExplicitPermissions(
-  state: InspectorState,
-  tags: string[] | undefined,
-  explicitPermissionsNode: ts.Expression | undefined,
-  checker: ts.TypeChecker
-): PermissionMetadata[] {
   const resolved: PermissionMetadata[] = []
-
-  // 1. Tag-based permission groups
-  if (tags && tags.length > 0) {
-    for (const tag of tags) {
-      if (state.permissions.tagPermissions.has(tag)) {
-        // Just reference the group by tag
-        resolved.push({
-          type: 'tag',
-          tag,
-        })
-      }
-    }
-  }
-
-  // 2. Explicit permissions (inline is OK here - used directly in wire/function)
-  if (explicitPermissionsNode) {
-    const permissionNames = extractPermissionPikkuNames(
-      explicitPermissionsNode,
-      checker,
-      state.rootDir
-    )
-    for (const name of permissionNames) {
-      const def = state.permissions.definitions[name]
-      resolved.push({
-        type: 'wire',
-        name,
-        inline: def?.exportedName === null,
-      })
-    }
-  }
-
-  return resolved
-}
-
-/**
- * Resolve permissions for a function based on:
- * 1. Tag-based permissions (addPermission('tag', [...]))
- * 2. Explicit function permissions (pikkuFunc({ permissions: [...] }))
- * Returns undefined if no permissions are found, otherwise returns array with at least one item
- */
-function resolveFunctionPermissionsInternal(
-  state: InspectorState,
-  tags: string[] | undefined,
-  explicitPermissionsNode: ts.Expression | undefined,
-  checker: ts.TypeChecker
-): PermissionMetadata[] | undefined {
-  const resolved = resolveTagAndExplicitPermissions(
-    state,
-    tags,
+  const permissionNames = extractPermissionPikkuNames(
     explicitPermissionsNode,
-    checker
+    checker,
+    state.rootDir
   )
+  for (const name of permissionNames) {
+    const def = state.permissions.definitions[name]
+    resolved.push({
+      type: 'wire',
+      name,
+      inline: def?.exportedName === null,
+    })
+  }
 
   return resolved.length > 0 ? resolved : undefined
 }
@@ -228,35 +115,8 @@ function resolveFunctionPermissionsInternal(
 export function resolvePermissions(
   state: InspectorState,
   obj: ts.ObjectLiteralExpression,
-  tags: string[] | undefined,
+  _tags: string[] | undefined,
   checker: ts.TypeChecker
 ): PermissionMetadata[] | undefined {
-  const explicitPermissionsNode = getPermissionsNode(obj)
-  return resolveFunctionPermissionsInternal(
-    state,
-    tags,
-    explicitPermissionsNode,
-    checker
-  )
-}
-
-/**
- * Convenience wrapper for HTTP: Extract permissions and resolve with HTTP-specific logic
- * Use this in add-http-route.ts for cleaner code
- */
-export function resolveHTTPPermissionsFromObject(
-  state: InspectorState,
-  route: string,
-  obj: ts.ObjectLiteralExpression,
-  tags: string[] | undefined,
-  checker: ts.TypeChecker
-): PermissionMetadata[] | undefined {
-  const explicitPermissionsNode = getPermissionsNode(obj)
-  return resolveHTTPPermissions(
-    state,
-    route,
-    tags,
-    explicitPermissionsNode,
-    checker
-  )
+  return resolveExplicitPermissions(state, getPermissionsNode(obj), checker)
 }