@pjts/eslint-style-rules 0.0.0-stage → 0.0.3

package/dist/lib/messages.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.walkOwnBody = exports.switchCaseNames = exports.nameProperty = exports.messageNameOf = exports.screamingSnake = void 0;
+/** `CatalogProfilePublished` → `CATALOG_PROFILE_PUBLISHED`. */
+const screamingSnake = (name) => name.replace(/(?<=[a-z0-9])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])/g, '_').toUpperCase();
+exports.screamingSnake = screamingSnake;
+/** `MessageNames.X` (expression or type position) → 'X'; anything else → null. */
+const messageNameOf = (node, enumName = 'MessageNames') => {
+    if (!node)
+        return null;
+    if (node.type === 'MemberExpression' && !node.computed && node.object.type === 'Identifier' && node.object.name === enumName)
+        return node.property.name;
+    if (node.type === 'TSTypeReference')
+        return (0, exports.messageNameOf)(node.typeName, enumName);
+    if (node.type === 'TSQualifiedName' && node.left.type === 'Identifier' && node.left.name === enumName)
+        return node.right.name;
+    return null;
+};
+exports.messageNameOf = messageNameOf;
+/** Names set in `name: MessageNames.X` of an object literal (spreads ignored). */
+const nameProperty = (objectExpression, enumName = 'MessageNames') => {
+    if (objectExpression?.type !== 'ObjectExpression')
+        return null;
+    const property = objectExpression.properties.find((p) => p.type === 'Property' && !p.computed && (p.key.name ?? p.key.value) === 'name');
+    return property ? { name: (0, exports.messageNameOf)(property.value, enumName), node: property } : null;
+};
+exports.nameProperty = nameProperty;
+/** Every `case MessageNames.X:` inside `node` (any switch). */
+const switchCaseNames = (node, enumName = 'MessageNames') => {
+    const names = new Set();
+    const visit = (current) => {
+        if (!current || typeof current.type !== 'string')
+            return;
+        if (current.type === 'SwitchCase') {
+            const name = (0, exports.messageNameOf)(current.test, enumName);
+            if (name)
+                names.add(name);
+        }
+        for (const key of Object.keys(current)) {
+            if (key === 'parent')
+                continue;
+            const value = current[key];
+            if (Array.isArray(value))
+                value.forEach(visit);
+            else if (value && typeof value === 'object')
+                visit(value);
+        }
+    };
+    visit(node);
+    return names;
+};
+exports.switchCaseNames = switchCaseNames;
+/** Depth-first walk that does not enter nested functions or classes. */
+const walkOwnBody = (node, visit) => {
+    if (!node || typeof node.type !== 'string')
+        return;
+    visit(node);
+    for (const key of Object.keys(node)) {
+        if (key === 'parent')
+            continue;
+        const value = node[key];
+        const step = (child) => {
+            if (!child || typeof child.type !== 'string')
+                return;
+            if (/Function|Class/.test(child.type))
+                return;
+            (0, exports.walkOwnBody)(child, visit);
+        };
+        if (Array.isArray(value))
+            value.forEach(step);
+        else if (value && typeof value === 'object')
+            step(value);
+    }
+};
+exports.walkOwnBody = walkOwnBody;
+//# sourceMappingURL=messages.js.map

package/dist/lib/messages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"messages.js","sourceRoot":"","sources":["../../src/lib/messages.ts"],"names":[],"mappings":";;;AAAA,+DAA+D;AACxD,MAAM,cAAc,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,kDAAkD,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;AAA/H,QAAA,cAAc,kBAAiH;AAE5I,kFAAkF;AAC3E,MAAM,aAAa,GAAG,CAAC,IAAS,EAAE,QAAQ,GAAG,cAAc,EAAiB,EAAE;IACnF,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IACxJ,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,IAAA,qBAAa,EAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACnF,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IAC9H,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AANW,QAAA,aAAa,iBAMxB;AAEF,kFAAkF;AAC3E,MAAM,YAAY,GAAG,CAAC,gBAAqB,EAAE,QAAQ,GAAG,cAAc,EAA6C,EAAE;IAC1H,IAAI,gBAAgB,EAAE,IAAI,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,CAAC;IAC9I,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAA,qBAAa,EAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7F,CAAC,CAAC;AAJW,QAAA,YAAY,gBAIvB;AAEF,+DAA+D;AACxD,MAAM,eAAe,GAAG,CAAC,IAAS,EAAE,QAAQ,GAAG,cAAc,EAAe,EAAE;IACnF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,KAAK,GAAG,CAAC,OAAY,EAAQ,EAAE;QACnC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO;QACzD,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,IAAA,qBAAa,EAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACnD,IAAI,IAAI;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,IAAI,GAAG,KAAK,QAAQ;gBAAE,SAAS;YAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;iBAC1C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,CAAC;IACZ,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAjBW,QAAA,eAAe,mBAiB1B;AAEF,wEAAwE;AACjE,MAAM,WAAW,GAAG,CAAC,IAAS,EAAE,KAA0B,EAAQ,EAAE;IACzE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO;IACnD,KAAK,CAAC,IAAI,CAAC,CAAC;IACZ,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,GAAG,KAAK,QAAQ;YAAE,SAAS;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,KAAU,EAAE,EAAE;YAC1B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO;YACrD,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,OAAO;YAC9C,IAAA,mBAAW,EAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC,CAAC;QACF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;aACzC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC,CAAC;AAdW,QAAA,WAAW,eActB"}

package/dist/lib/rule.d.ts

@@ -0,0 +1,9 @@
+import type { Rule } from 'eslint';
+/**
+ * Types a rule for ESLint while keeping its visitors loosely typed: the rules read TypeScript AST
+ * fields (decorators, type annotations, accessibility) that ESLint's ESTree types don't describe.
+ */
+export declare const defineRule: (rule: {
+    meta: Record<string, any>;
+    create: (context: Rule.RuleContext) => Record<string, any>;
+}) => Rule.RuleModule;

package/dist/lib/rule.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defineRule = void 0;
+/**
+ * Types a rule for ESLint while keeping its visitors loosely typed: the rules read TypeScript AST
+ * fields (decorators, type annotations, accessibility) that ESLint's ESTree types don't describe.
+ */
+const defineRule = (rule) => rule;
+exports.defineRule = defineRule;
+//# sourceMappingURL=rule.js.map

package/dist/lib/rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule.js","sourceRoot":"","sources":["../../src/lib/rule.ts"],"names":[],"mappings":";;;AAEA;;;GAGG;AACI,MAAM,UAAU,GAAG,CAAC,IAA+F,EAAmB,EAAE,CAC7I,IAAkC,CAAC;AADxB,QAAA,UAAU,cACc"}

package/dist/rules/app-class-suffix.d.ts

@@ -0,0 +1,3 @@
+/** Application-layer classes are use-case entry points: `…Service`, `…Handler` or `…View`. */
+declare const _default: import("eslint").Rule.RuleModule;
+export default _default;

package/dist/rules/app-class-suffix.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const rule_1 = require("../lib/rule");
+/** Application-layer classes are use-case entry points: `…Service`, `…Handler` or `…View`. */
+exports.default = (0, rule_1.defineRule)({
+    meta: {
+        type: 'suggestion',
+        docs: { description: 'Require app-layer class names to end with an allowed suffix' },
+        messages: { suffix: 'App-layer class "{{name}}" must end with {{allowed}}.' },
+        schema: [{
+                type: 'object',
+                properties: { allowed: { type: 'array', items: { type: 'string' }, minItems: 1 } },
+                additionalProperties: false,
+            }],
+    },
+    create(context) {
+        const allowed = context.options[0]?.allowed ?? ['Service', 'Handler', 'View'];
+        return {
+            'ClassDeclaration[id]'(node) {
+                const name = node.id.name;
+                if (!allowed.some((suffix) => name.endsWith(suffix))) {
+                    context.report({ node: node.id, messageId: 'suffix', data: { name, allowed: allowed.map((s) => `"${s}"`).join(' | ') } });
+                }
+            },
+        };
+    },
+});
+//# sourceMappingURL=app-class-suffix.js.map

package/dist/rules/app-class-suffix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-class-suffix.js","sourceRoot":"","sources":["../../src/rules/app-class-suffix.ts"],"names":[],"mappings":";;AAAA,sCAAyC;AACzC,8FAA8F;AAC9F,kBAAe,IAAA,iBAAU,EAAC;IACxB,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,EAAE,WAAW,EAAE,6DAA6D,EAAE;QACpF,QAAQ,EAAE,EAAE,MAAM,EAAE,uDAAuD,EAAE;QAC7E,MAAM,EAAE,CAAC;gBACP,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE;gBAClF,oBAAoB,EAAE,KAAK;aAC5B,CAAC;KACH;IACD,MAAM,CAAC,OAAO;QACZ,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9E,OAAO;YACL,sBAAsB,CAAC,IAAI;gBACzB,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;gBAC1B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;oBACrD,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC5H,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/dist/rules/app-service-endpoints.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Every public method of an `@AppService` class is an HTTP endpoint: it carries exactly one HTTP
+ * method decorator, and every parameter carries a request-binding decorator.
+ *
+ *   @Post
+ *   public async login(@Body dto: LoginDto, @Ip ip: ClientIp): Promise<…>
+ *
+ * Non-public methods are helpers and must not carry an HTTP method decorator. Other method
+ * decorators (`@Pipe(...)` guards) are allowed alongside.
+ */
+declare const _default: import("eslint").Rule.RuleModule;
+export default _default;

package/dist/rules/app-service-endpoints.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const ast_1 = require("../lib/ast");
+const rule_1 = require("../lib/rule");
+/** `@Foo` and `@Foo(...)` → 'Foo'. */
+const decoratorName = (decorator) => decorator.expression.type === 'CallExpression' ? decorator.expression.callee.name : decorator.expression.name;
+/**
+ * Every public method of an `@AppService` class is an HTTP endpoint: it carries exactly one HTTP
+ * method decorator, and every parameter carries a request-binding decorator.
+ *
+ *   @Post
+ *   public async login(@Body dto: LoginDto, @Ip ip: ClientIp): Promise<…>
+ *
+ * Non-public methods are helpers and must not carry an HTTP method decorator. Other method
+ * decorators (`@Pipe(...)` guards) are allowed alongside.
+ */
+exports.default = (0, rule_1.defineRule)({
+    meta: {
+        type: 'problem',
+        docs: { description: 'Require HTTP and parameter decorators on @AppService public methods' },
+        messages: {
+            missingHttp: 'Public method `{{method}}` of @{{service}} class must be decorated with one of {{http}}.',
+            multipleHttp: 'Method `{{method}}` has several HTTP method decorators ({{found}}) — keep exactly one.',
+            missingParam: 'Parameter `{{param}}` of `{{method}}` must be decorated with one of {{params}}.',
+            helperEndpoint: '`{{method}}` is not public, so it must not carry @{{found}} — make it public or drop the decorator.',
+        },
+        schema: [{
+                type: 'object',
+                properties: {
+                    serviceDecorators: { type: 'array', items: { type: 'string' } },
+                    httpDecorators: { type: 'array', items: { type: 'string' } },
+                    paramDecorators: { type: 'array', items: { type: 'string' } },
+                },
+                additionalProperties: false,
+            }],
+    },
+    create(context) {
+        const { serviceDecorators = ['AppService'], httpDecorators = ['Get', 'Post', 'Put', 'Patch', 'Delete'], paramDecorators = ['Auth', 'Body', 'UrlParam', 'QueryParam', 'QueryParams', 'Header', 'Ip', 'File'], } = context.options[0] ?? {};
+        const list = (names) => names.map((name) => `@${name}`).join(' | ');
+        const paramNode = (param) => (param.type === 'TSParameterProperty' ? param.parameter : param);
+        const paramLabel = (param) => {
+            const node = paramNode(param);
+            const target = node.type === 'AssignmentPattern' ? node.left : node.type === 'RestElement' ? node.argument : node;
+            return target.type === 'Identifier' ? target.name : context.sourceCode.getText(target);
+        };
+        return {
+            ClassDeclaration(classNode) {
+                const service = (0, ast_1.decoratorNames)(classNode).find((name) => serviceDecorators.includes(name));
+                if (!service)
+                    return;
+                for (const member of classNode.body.body) {
+                    if (member.type !== 'MethodDefinition' || member.kind !== 'method' || member.static || member.computed)
+                        continue;
+                    const method = member.key.name ?? member.key.value;
+                    const http = (member.decorators ?? []).map(decoratorName).filter((name) => httpDecorators.includes(name));
+                    const isPublic = member.accessibility !== 'private' && member.accessibility !== 'protected' && member.key.type !== 'PrivateIdentifier';
+                    if (!isPublic) {
+                        if (http.length)
+                            context.report({ node: member.key, messageId: 'helperEndpoint', data: { method, found: http.join(', @') } });
+                        continue;
+                    }
+                    if (http.length === 0) {
+                        context.report({ node: member.key, messageId: 'missingHttp', data: { method, service, http: list(httpDecorators) } });
+                    }
+                    else if (http.length > 1) {
+                        context.report({ node: member.key, messageId: 'multipleHttp', data: { method, found: http.map((n) => `@${n}`).join(', ') } });
+                    }
+                    for (const param of member.value.params) {
+                        const decorators = [...(param.decorators ?? []), ...(paramNode(param).decorators ?? [])].map(decoratorName);
+                        if (!decorators.some((name) => paramDecorators.includes(name))) {
+                            context.report({ node: param, messageId: 'missingParam', data: { param: paramLabel(param), method, params: list(paramDecorators) } });
+                        }
+                    }
+                }
+            },
+        };
+    },
+});
+//# sourceMappingURL=app-service-endpoints.js.map

package/dist/rules/app-service-endpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-service-endpoints.js","sourceRoot":"","sources":["../../src/rules/app-service-endpoints.ts"],"names":[],"mappings":";;AAAA,oCAA4C;AAC5C,sCAAyC;AAEzC,sCAAsC;AACtC,MAAM,aAAa,GAAG,CAAC,SAAS,EAAE,EAAE,CAClC,SAAS,CAAC,UAAU,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;AAEhH;;;;;;;;;GASG;AACH,kBAAe,IAAA,iBAAU,EAAC;IACxB,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE,WAAW,EAAE,qEAAqE,EAAE;QAC5F,QAAQ,EAAE;YACR,WAAW,EAAE,0FAA0F;YACvG,YAAY,EAAE,wFAAwF;YACtG,YAAY,EAAE,iFAAiF;YAC/F,cAAc,EAAE,qGAAqG;SACtH;QACD,MAAM,EAAE,CAAC;gBACP,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,iBAAiB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;oBAC/D,cAAc,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;oBAC5D,eAAe,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;iBAC9D;gBACD,oBAAoB,EAAE,KAAK;aAC5B,CAAC;KACH;IACD,MAAM,CAAC,OAAO;QACZ,MAAM,EACJ,iBAAiB,GAAG,CAAC,YAAY,CAAC,EAClC,cAAc,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,EAC1D,eAAe,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,GACpG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAEpE,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC9F,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,EAAE;YAC3B,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;YAClH,OAAO,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzF,CAAC,CAAC;QAEF,OAAO;YACL,gBAAgB,CAAC,SAAS;gBACxB,MAAM,OAAO,GAAG,IAAA,oBAAc,EAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC3F,IAAI,CAAC,OAAO;oBAAE,OAAO;gBAErB,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACzC,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ;wBAAE,SAAS;oBACjH,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;oBACnD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC1G,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,KAAK,WAAW,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,mBAAmB,CAAC;oBAEvI,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACd,IAAI,IAAI,CAAC,MAAM;4BAAE,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;wBAC9H,SAAS;oBACX,CAAC;oBACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBACtB,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxH,CAAC;yBAAM,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAC3B,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;oBAChI,CAAC;oBAED,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;wBACxC,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;wBAC5G,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;4BAC/D,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC;wBACxI,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/dist/rules/auth-access.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Every authenticated endpoint declares the right it needs (altbra `common/core/AuthAccess.ts`):
+ *
+ *   @Get
+ *   public async findBySku(@AuthAccess('distribution:read', 'offer:read') _authToken: AuthToken, …)
+ *
+ * In `@AppService` classes, a parameter typed `AuthToken` must use `@AuthAccess(...)` with at least one
+ * right matching `rightPattern` (several rights = any of them). Plain `@Auth` is allowed only for the
+ * `Service.method` (or `File.method`) entries in `allow` — endpoints whose right is not decided yet; an entry that already
+ * uses @AuthAccess is reported so the list shrinks. With `checkParamName` (default) the parameter is
+ * named `authToken`, or `_authToken` when the method body doesn't read it.
+ */
+declare const _default: import("eslint").Rule.RuleModule;
+export default _default;

package/dist/rules/auth-access.js

@@ -0,0 +1,122 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const rule_1 = require("../lib/rule");
+const ast_1 = require("../lib/ast");
+const db_1 = require("../lib/db");
+/** `@Foo` / `@Foo(...)` → { name, args } */
+const decoratorCall = (decorator) => decorator.expression.type === 'CallExpression'
+    ? { name: decorator.expression.callee.name, args: decorator.expression.arguments }
+    : { name: decorator.expression.name, args: [] };
+/**
+ * Every authenticated endpoint declares the right it needs (altbra `common/core/AuthAccess.ts`):
+ *
+ *   @Get
+ *   public async findBySku(@AuthAccess('distribution:read', 'offer:read') _authToken: AuthToken, …)
+ *
+ * In `@AppService` classes, a parameter typed `AuthToken` must use `@AuthAccess(...)` with at least one
+ * right matching `rightPattern` (several rights = any of them). Plain `@Auth` is allowed only for the
+ * `Service.method` (or `File.method`) entries in `allow` — endpoints whose right is not decided yet; an entry that already
+ * uses @AuthAccess is reported so the list shrinks. With `checkParamName` (default) the parameter is
+ * named `authToken`, or `_authToken` when the method body doesn't read it.
+ */
+exports.default = (0, rule_1.defineRule)({
+    meta: {
+        type: 'problem',
+        docs: { description: 'Require an access right on every authenticated endpoint' },
+        messages: {
+            plainAuth: '`{{method}}` must declare its right: `@{{decorator}}(\'scope:read\') authToken: {{tokenType}}` instead of @{{found}}.',
+            noRights: '@{{decorator}} needs at least one right, e.g. @{{decorator}}(\'scope:read\').',
+            badRight: 'Access right {{right}} must match {{pattern}}.',
+            dynamicRight: 'Access rights are string literals so they can be audited — not `{{text}}`.',
+            paramName: 'Name the {{tokenType}} parameter `{{expected}}`.',
+            stale: '"{{entry}}" is in the plain-@Auth allowlist but already uses @{{decorator}} — remove it from the list.',
+        },
+        schema: [{
+                type: 'object',
+                properties: {
+                    decorator: { type: 'string' },
+                    plainDecorators: { type: 'array', items: { type: 'string' } },
+                    tokenType: { type: 'string' },
+                    serviceDecorators: { type: 'array', items: { type: 'string' } },
+                    rightPattern: { type: 'string' },
+                    allow: { type: 'array', items: { type: 'string' } },
+                    checkParamName: { type: 'boolean' },
+                },
+                additionalProperties: false,
+            }],
+    },
+    create(context) {
+        const { decorator = 'AuthAccess', plainDecorators = ['Auth'], tokenType = 'AuthToken', serviceDecorators = ['AppService'], rightPattern = '^[a-z][a-z0-9-]*:(read|write)$', allow = [], checkParamName = true, } = context.options[0] ?? {};
+        const pattern = new RegExp(rightPattern);
+        const readsParam = (body, name) => {
+            let found = false;
+            const visit = (node) => {
+                if (found || !node || typeof node.type !== 'string')
+                    return;
+                const parent = node.parent;
+                const isKey = (parent?.type === 'Property' && parent.key === node && !parent.shorthand) || (parent?.type === 'MemberExpression' && parent.property === node && !parent.computed);
+                if (node.type === 'Identifier' && node.name === name && !isKey)
+                    found = true;
+                for (const key of Object.keys(node)) {
+                    if (key === 'parent')
+                        continue;
+                    const value = node[key];
+                    if (Array.isArray(value))
+                        value.forEach(visit);
+                    else if (value && typeof value === 'object')
+                        visit(value);
+                }
+            };
+            visit(body);
+            return found;
+        };
+        return {
+            ClassDeclaration(classNode) {
+                if (!(0, ast_1.decoratorNames)(classNode).some((name) => serviceDecorators.includes(name)))
+                    return;
+                const service = classNode.id?.name ?? '';
+                const fileBase = context.filename.split(/[\\/]/).pop().replace(/\.ts$/, '');
+                for (const member of classNode.body.body) {
+                    if (member.type !== 'MethodDefinition' || member.kind !== 'method')
+                        continue;
+                    const method = member.key.name ?? member.key.value;
+                    const entry = `${service}.${method}`;
+                    // Allowlist entries may name the class or the file (altbra's list keys by file name).
+                    const allowed = allow.includes(entry) || allow.includes(`${fileBase}.${method}`);
+                    for (const param of member.value.params) {
+                        const binding = (0, db_1.paramBinding)(param);
+                        const type = binding.typeAnnotation?.typeAnnotation;
+                        if (type?.type !== 'TSTypeReference' || type.typeName.name !== tokenType)
+                            continue;
+                        const calls = [...(param.decorators ?? []), ...(binding.decorators ?? [])].map(decoratorCall);
+                        const access = calls.find((call) => call.name === decorator);
+                        const plain = calls.find((call) => plainDecorators.includes(call.name));
+                        if (access) {
+                            if (allowed)
+                                context.report({ node: param, messageId: 'stale', data: { entry, decorator } });
+                            if (access.args.length === 0)
+                                context.report({ node: param, messageId: 'noRights', data: { decorator } });
+                            for (const arg of access.args) {
+                                if (arg.type !== 'Literal' || typeof arg.value !== 'string') {
+                                    context.report({ node: arg, messageId: 'dynamicRight', data: { text: context.sourceCode.getText(arg) } });
+                                }
+                                else if (!pattern.test(arg.value)) {
+                                    context.report({ node: arg, messageId: 'badRight', data: { right: `'${arg.value}'`, pattern: rightPattern } });
+                                }
+                            }
+                        }
+                        else if (plain && !allowed) {
+                            context.report({ node: param, messageId: 'plainAuth', data: { method: entry, decorator, tokenType, found: plain.name } });
+                        }
+                        if (checkParamName && binding.type === 'Identifier' && (access || plain)) {
+                            const expected = readsParam(member.value.body, binding.name) ? 'authToken' : '_authToken';
+                            if (binding.name !== expected)
+                                context.report({ node: binding, messageId: 'paramName', data: { tokenType, expected } });
+                        }
+                    }
+                }
+            },
+        };
+    },
+});
+//# sourceMappingURL=auth-access.js.map

package/dist/rules/auth-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-access.js","sourceRoot":"","sources":["../../src/rules/auth-access.ts"],"names":[],"mappings":";;AAAA,sCAAyC;AACzC,oCAA4C;AAC5C,kCAAyC;AAEzC,4CAA4C;AAC5C,MAAM,aAAa,GAAG,CAAC,SAAc,EAAE,EAAE,CACvC,SAAS,CAAC,UAAU,CAAC,IAAI,KAAK,gBAAgB;IAC5C,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,UAAU,CAAC,SAAS,EAAE;IAClF,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AAEpD;;;;;;;;;;;GAWG;AACH,kBAAe,IAAA,iBAAU,EAAC;IACxB,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE,WAAW,EAAE,yDAAyD,EAAE;QAChF,QAAQ,EAAE;YACR,SAAS,EAAE,uHAAuH;YAClI,QAAQ,EAAE,+EAA+E;YACzF,QAAQ,EAAE,gDAAgD;YAC1D,YAAY,EAAE,4EAA4E;YAC1F,SAAS,EAAE,kDAAkD;YAC7D,KAAK,EAAE,wGAAwG;SAChH;QACD,MAAM,EAAE,CAAC;gBACP,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC7B,eAAe,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;oBAC7D,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC7B,iBAAiB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;oBAC/D,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAChC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;oBACnD,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;iBACpC;gBACD,oBAAoB,EAAE,KAAK;aAC5B,CAAC;KACH;IACD,MAAM,CAAC,OAAO;QACZ,MAAM,EACJ,SAAS,GAAG,YAAY,EACxB,eAAe,GAAG,CAAC,MAAM,CAAC,EAC1B,SAAS,GAAG,WAAW,EACvB,iBAAiB,GAAG,CAAC,YAAY,CAAC,EAClC,YAAY,GAAG,gCAAgC,EAC/C,KAAK,GAAG,EAAE,EACV,cAAc,GAAG,IAAI,GACtB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC;QAEzC,MAAM,UAAU,GAAG,CAAC,IAAS,EAAE,IAAY,EAAW,EAAE;YACtD,IAAI,KAAK,GAAG,KAAK,CAAC;YAClB,MAAM,KAAK,GAAG,CAAC,IAAS,EAAE,EAAE;gBAC1B,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO;gBAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBAC3B,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,IAAI,KAAK,UAAU,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,kBAAkB,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACjL,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK;oBAAE,KAAK,GAAG,IAAI,CAAC;gBAC7E,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpC,IAAI,GAAG,KAAK,QAAQ;wBAAE,SAAS;oBAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;oBACxB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;wBAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;yBAC1C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;wBAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC5D,CAAC;YACH,CAAC,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,CAAC;YACZ,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF,OAAO;YACL,gBAAgB,CAAC,SAAS;gBACxB,IAAI,CAAC,IAAA,oBAAc,EAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBAAE,OAAO;gBAChG,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC;gBACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC7E,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACzC,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;wBAAE,SAAS;oBAC7E,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;oBACnD,MAAM,KAAK,GAAG,GAAG,OAAO,IAAI,MAAM,EAAE,CAAC;oBACrC,sFAAsF;oBACtF,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC,CAAC;oBACjF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;wBACxC,MAAM,OAAO,GAAG,IAAA,iBAAY,EAAC,KAAK,CAAC,CAAC;wBACpC,MAAM,IAAI,GAAG,OAAO,CAAC,cAAc,EAAE,cAAc,CAAC;wBACpD,IAAI,IAAI,EAAE,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS;4BAAE,SAAS;wBACnF,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;wBAC9F,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;wBAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;wBAExE,IAAI,MAAM,EAAE,CAAC;4BACX,IAAI,OAAO;gCAAE,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;4BAC7F,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gCAAE,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;4BAC1G,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gCAC9B,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oCAC5D,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;gCAC5G,CAAC;qCAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oCACpC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,KAAK,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;gCACjH,CAAC;4BACH,CAAC;wBACH,CAAC;6BAAM,IAAI,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;4BAC7B,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;wBAC5H,CAAC;wBAED,IAAI,cAAc,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,EAAE,CAAC;4BACzE,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC;4BAC1F,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;gCAAE,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;wBAC1H,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/dist/rules/db-client-dependency.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The database client (`PostgresDbClient`, knex, pg) is a dependency of `…Pg…Repository` classes only.
+ * A class depends on it when a constructor/method parameter or a field is typed with it; a plain
+ * function depends on it when one of its parameters is. Interfaces and type aliases (module contexts,
+ * record shapes) are types, not dependencies, and stay allowed.
+ *
+ * Options: `allowedClasses` — name patterns of the classes allowed to depend on it
+ * (default `['^([A-Z][a-z]+)*Pg[A-Z]\\w*Repository$']` — `Pg` anywhere in a combined prefix: PgX, PgNatsX, NatsPgX), `clients` — `module#ImportedName` specs.
+ */
+declare const _default: import("eslint").Rule.RuleModule;
+export default _default;

package/dist/rules/db-client-dependency.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const db_1 = require("../lib/db");
+const rule_1 = require("../lib/rule");
+/**
+ * The database client (`PostgresDbClient`, knex, pg) is a dependency of `…Pg…Repository` classes only.
+ * A class depends on it when a constructor/method parameter or a field is typed with it; a plain
+ * function depends on it when one of its parameters is. Interfaces and type aliases (module contexts,
+ * record shapes) are types, not dependencies, and stay allowed.
+ *
+ * Options: `allowedClasses` — name patterns of the classes allowed to depend on it
+ * (default `['^([A-Z][a-z]+)*Pg[A-Z]\\w*Repository$']` — `Pg` anywhere in a combined prefix: PgX, PgNatsX, NatsPgX), `clients` — `module#ImportedName` specs.
+ */
+exports.default = (0, rule_1.defineRule)({
+    meta: {
+        type: 'problem',
+        docs: { description: 'Only …Pg…Repository classes may depend on the database client' },
+        messages: {
+            classDependency: '"{{name}}" depends on {{client}} — only {{allowed}} classes may. Go through a repository port, or make this a {{allowed}} in infrastructure/repositories/pg/.',
+            functionDependency: 'Function "{{name}}" takes {{client}} — only {{allowed}} classes may depend on the database client.',
+        },
+        schema: [{
+                type: 'object',
+                properties: {
+                    allowedClasses: { type: 'array', items: { type: 'string' } },
+                    clients: { type: 'array', items: { type: 'string' } },
+                },
+                additionalProperties: false,
+            }],
+    },
+    create(context) {
+        const { allowedClasses = ['^([A-Z][a-z]+)*Pg[A-Z]\\w*Repository$'], clients = db_1.DEFAULT_CLIENTS } = context.options[0] ?? {};
+        const allowed = allowedClasses.map((pattern) => new RegExp(pattern));
+        const allowedLabel = context.options[0]?.allowedClasses ? allowedClasses.join(' / ') : '…Pg…Repository';
+        const tracker = (0, db_1.clientTypeTracker)(clients);
+        const clientName = (annotation) => context.sourceCode.getText(annotation.typeAnnotation ?? annotation);
+        /** First client-typed parameter of a function, if any. */
+        const clientParam = (fn) => fn.params.map(db_1.paramBinding).find((binding) => tracker.usesClient(binding.typeAnnotation));
+        const checkClass = (classNode) => {
+            const name = classNode.id?.name ?? '(anonymous class)';
+            if (allowed.some((pattern) => pattern.test(name)))
+                return;
+            for (const member of classNode.body.body) {
+                let annotation = null;
+                if (member.type === 'PropertyDefinition' && tracker.usesClient(member.typeAnnotation))
+                    annotation = member.typeAnnotation;
+                if (member.type === 'MethodDefinition')
+                    annotation = clientParam(member.value)?.typeAnnotation ?? null;
+                if (annotation) {
+                    context.report({ node: member.key ?? member, messageId: 'classDependency', data: { name, client: clientName(annotation), allowed: allowedLabel } });
+                    return; // one report per class is enough
+                }
+            }
+        };
+        const checkFunction = (fn) => {
+            if (fn.parent.type === 'MethodDefinition')
+                return; // covered by the class check
+            const binding = clientParam(fn);
+            if (!binding)
+                return;
+            const name = fn.id?.name ?? (fn.parent.type === 'VariableDeclarator' ? fn.parent.id.name : '(anonymous)');
+            context.report({ node: binding, messageId: 'functionDependency', data: { name, client: clientName(binding.typeAnnotation), allowed: allowedLabel } });
+        };
+        return {
+            ImportDeclaration: (node) => tracker.onImport(node),
+            ClassDeclaration: checkClass,
+            ClassExpression: checkClass,
+            FunctionDeclaration: checkFunction,
+            FunctionExpression: checkFunction,
+            ArrowFunctionExpression: checkFunction,
+        };
+    },
+});
+//# sourceMappingURL=db-client-dependency.js.map

package/dist/rules/db-client-dependency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-client-dependency.js","sourceRoot":"","sources":["../../src/rules/db-client-dependency.ts"],"names":[],"mappings":";;AAAA,kCAA6E;AAC7E,sCAAyC;AAEzC;;;;;;;;GAQG;AACH,kBAAe,IAAA,iBAAU,EAAC;IACxB,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE,WAAW,EAAE,+DAA+D,EAAE;QACtF,QAAQ,EAAE;YACR,eAAe,EAAE,+JAA+J;YAChL,kBAAkB,EAAE,oGAAoG;SACzH;QACD,MAAM,EAAE,CAAC;gBACP,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,cAAc,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;oBAC5D,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;iBACtD;gBACD,oBAAoB,EAAE,KAAK;aAC5B,CAAC;KACH;IACD,MAAM,CAAC,OAAO;QACZ,MAAM,EAAE,cAAc,GAAG,CAAC,uCAAuC,CAAC,EAAE,OAAO,GAAG,oBAAe,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3H,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACrE,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC;QACxG,MAAM,OAAO,GAAG,IAAA,sBAAiB,EAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,IAAI,UAAU,CAAC,CAAC;QAEvG,0DAA0D;QAC1D,MAAM,WAAW,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAY,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QAEtH,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,EAAE;YAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,EAAE,IAAI,IAAI,mBAAmB,CAAC;YACvD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAE,OAAO;YAC1D,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACzC,IAAI,UAAU,GAAG,IAAI,CAAC;gBACtB,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAoB,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,cAAc,CAAC;oBAAE,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC;gBAC1H,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB;oBAAE,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,cAAc,IAAI,IAAI,CAAC;gBACvG,IAAI,UAAU,EAAE,CAAC;oBACf,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;oBACpJ,OAAO,CAAC,iCAAiC;gBAC3C,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,aAAa,GAAG,CAAC,EAAE,EAAE,EAAE;YAC3B,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB;gBAAE,OAAO,CAAC,6BAA6B;YAChF,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;YAChC,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;YAC1G,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QACxJ,CAAC,CAAC;QAEF,OAAO;YACL,iBAAiB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YACnD,gBAAgB,EAAE,UAAU;YAC5B,eAAe,EAAE,UAAU;YAC3B,mBAAmB,EAAE,aAAa;YAClC,kBAAkB,EAAE,aAAa;YACjC,uBAAuB,EAAE,aAAa;SACvC,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/dist/rules/db-writes-in-repositories.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Database writes happen only in the infrastructure layer, inside a `…Pg…Repository` class (Pg anywhere in the prefix).
+ * Flags write calls whose chain starts at a DB handle — a field or parameter typed with the client
+ * (`this.db(...)`, `db(...)`), a variable holding a query built from one, or `<x>.postgresDbClient` —
+ * anywhere else. Writes: insert/update/del/delete/truncate/upsert/increment/decrement/onConflict,
+ * transaction, and raw SQL starting with a writing statement. `entity.update(dto)` is not a DB call.
+ *
+ * Options: `allowedClasses` (default `['^([A-Z][a-z]+)*Pg[A-Z]\\w*Repository$']` — `Pg` anywhere in a combined prefix: PgX, PgNatsX, NatsPgX), `allowedPath` (default
+ * `/infrastructure/`), `clients`.
+ */
+declare const _default: import("eslint").Rule.RuleModule;
+export default _default;

package/dist/rules/db-writes-in-repositories.js

@@ -0,0 +1,105 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const db_1 = require("../lib/db");
+const ast_1 = require("../lib/ast");
+const rule_1 = require("../lib/rule");
+const WRITE_METHODS = new Set(['insert', 'update', 'del', 'delete', 'truncate', 'upsert', 'increment', 'decrement', 'onConflict', 'transaction']);
+const WRITE_SQL = /^\s*(insert|update|delete|truncate|merge|upsert|alter|drop|create|grant|revoke|copy)\b/i;
+/**
+ * Database writes happen only in the infrastructure layer, inside a `…Pg…Repository` class (Pg anywhere in the prefix).
+ * Flags write calls whose chain starts at a DB handle — a field or parameter typed with the client
+ * (`this.db(...)`, `db(...)`), a variable holding a query built from one, or `<x>.postgresDbClient` —
+ * anywhere else. Writes: insert/update/del/delete/truncate/upsert/increment/decrement/onConflict,
+ * transaction, and raw SQL starting with a writing statement. `entity.update(dto)` is not a DB call.
+ *
+ * Options: `allowedClasses` (default `['^([A-Z][a-z]+)*Pg[A-Z]\\w*Repository$']` — `Pg` anywhere in a combined prefix: PgX, PgNatsX, NatsPgX), `allowedPath` (default
+ * `/infrastructure/`), `clients`.
+ */
+exports.default = (0, rule_1.defineRule)({
+    meta: {
+        type: 'problem',
+        docs: { description: 'Allow database writes only in infrastructure …Pg…Repository classes' },
+        messages: {
+            write: '`{{method}}` writes to the database — writes belong in a …Pg…Repository in infrastructure/{{where}}.',
+            rawWrite: 'This raw SQL writes to the database — writes belong in a …Pg…Repository in infrastructure/{{where}}.',
+        },
+        schema: [{
+                type: 'object',
+                properties: {
+                    allowedClasses: { type: 'array', items: { type: 'string' } },
+                    allowedPath: { type: 'string' },
+                    clients: { type: 'array', items: { type: 'string' } },
+                },
+                additionalProperties: false,
+            }],
+    },
+    create(context) {
+        const { allowedClasses = ['^([A-Z][a-z]+)*Pg[A-Z]\\w*Repository$'], allowedPath = '/infrastructure/', clients = db_1.DEFAULT_CLIENTS } = context.options[0] ?? {};
+        const allowed = allowedClasses.map((pattern) => new RegExp(pattern));
+        const inAllowedPath = (0, ast_1.filePath)(context).includes(allowedPath);
+        const tracker = (0, db_1.clientTypeTracker)(clients);
+        /** Where the write sits, or null when it is in an allowed repository. */
+        const misplaced = (node) => {
+            const owner = (0, ast_1.findLast)(context.sourceCode.getAncestors(node), (a) => a.type === 'ClassDeclaration' || a.type === 'ClassExpression');
+            const name = owner?.id?.name;
+            if (inAllowedPath && name && allowed.some((pattern) => pattern.test(name)))
+                return null;
+            return name ? ` (found in "${name}")` : ' (found outside any class)';
+        };
+        /** Names holding a DB handle: client-typed fields/parameters and variables derived from them. */
+        const handles = new Set();
+        const isHandleRoot = (node) => {
+            let current = node;
+            for (;;) {
+                if (current.type === 'CallExpression')
+                    current = current.callee;
+                else if (current.type === 'AwaitExpression' || current.type === 'TSNonNullExpression')
+                    current = current.argument ?? current.expression;
+                else if (current.type === 'MemberExpression') {
+                    if (!current.computed && current.property.name === 'postgresDbClient')
+                        return true;
+                    if (current.object.type === 'ThisExpression')
+                        return !current.computed && handles.has(current.property.name);
+                    current = current.object;
+                }
+                else
+                    return current.type === 'Identifier' && handles.has(current.name);
+            }
+        };
+        return {
+            ImportDeclaration: (node) => tracker.onImport(node),
+            ':function'(fn) {
+                for (const binding of fn.params.map(db_1.paramBinding)) {
+                    if (binding.type === 'Identifier' && tracker.usesClient(binding.typeAnnotation))
+                        handles.add(binding.name);
+                }
+            },
+            PropertyDefinition(node) {
+                if (node.key.type === 'Identifier' && tracker.usesClient(node.typeAnnotation))
+                    handles.add(node.key.name);
+            },
+            VariableDeclarator(node) {
+                if (node.id.type === 'Identifier' && node.init && isHandleRoot(node.init))
+                    handles.add(node.id.name);
+            },
+            'CallExpression[callee.type="MemberExpression"][callee.computed=false]'(node) {
+                if (!isHandleRoot(node.callee.object))
+                    return;
+                const method = node.callee.property.name;
+                if (WRITE_METHODS.has(method)) {
+                    const where = misplaced(node);
+                    if (where !== null)
+                        context.report({ node: node.callee.property, messageId: 'write', data: { method: `.${method}()`, where } });
+                }
+                else if (method === 'raw') {
+                    const sql = node.arguments[0];
+                    const text = sql?.type === 'Literal' ? String(sql.value) : sql?.type === 'TemplateLiteral' ? sql.quasis[0].value.cooked : '';
+                    const where = WRITE_SQL.test(text) ? misplaced(node) : null;
+                    if (where !== null)
+                        context.report({ node: sql, messageId: 'rawWrite', data: { where } });
+                }
+            },
+        };
+    },
+});
+//# sourceMappingURL=db-writes-in-repositories.js.map