@prairielearn/eslint-plugin 2.2.7 → 2.3.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @prairielearn/eslint-plugin
 
+## 2.3.0
+
+### Minor Changes
+
+- 2aa898c: Add new `safe-db-types` rule
+
 ## 2.2.7
 
 ### Patch Changes

package/dist/index.d.ts

@@ -3,5 +3,8 @@ export declare const rules: {
     'aws-client-shared-config': import("@typescript-eslint/utils/ts-eslint").RuleModule<"improperConfig" | "unknownConfig", [], unknown, import("@typescript-eslint/utils/ts-eslint").RuleListener>;
     'jsx-no-dollar-interpolation': import("@typescript-eslint/utils/ts-eslint").RuleModule<"dollarInterpolationNotAllowed", [], unknown, import("@typescript-eslint/utils/ts-eslint").RuleListener>;
     'no-unused-sql-blocks': import("@typescript-eslint/utils/ts-eslint").RuleModule<"unusedSqlBlock", [], unknown, import("@typescript-eslint/utils/ts-eslint").RuleListener>;
+    'safe-db-types': import("@typescript-eslint/utils/ts-eslint").RuleModule<"unsafeTypes" | "spreadAttributes", [({
+        allowDbTypes?: (string | RegExp)[];
+    } | undefined)?], unknown, import("@typescript-eslint/utils/ts-eslint").RuleListener>;
 };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,KAAK;;;;;CAKjB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,KAAK;;;;;;;;CAMjB,CAAC"}

package/dist/index.js

@@ -5,10 +5,12 @@ const aws_client_mandatory_config_js_1 = require("./rules/aws-client-mandatory-c
 const aws_client_shared_config_js_1 = require("./rules/aws-client-shared-config.js");
 const jsx_no_dollar_interpolation_js_1 = require("./rules/jsx-no-dollar-interpolation.js");
 const no_unused_sql_blocks_js_1 = require("./rules/no-unused-sql-blocks.js");
+const safe_db_types_js_1 = require("./rules/safe-db-types.js");
 exports.rules = {
     'aws-client-mandatory-config': aws_client_mandatory_config_js_1.default,
     'aws-client-shared-config': aws_client_shared_config_js_1.default,
     'jsx-no-dollar-interpolation': jsx_no_dollar_interpolation_js_1.default,
     'no-unused-sql-blocks': no_unused_sql_blocks_js_1.default,
+    'safe-db-types': safe_db_types_js_1.default,
 };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,2FAA8E;AAC9E,qFAAwE;AACxE,2FAA8E;AAC9E,6EAAgE;AAEnD,QAAA,KAAK,GAAG;IACnB,6BAA6B,EAAE,wCAAwB;IACvD,0BAA0B,EAAE,qCAAqB;IACjD,6BAA6B,EAAE,wCAAwB;IACvD,sBAAsB,EAAE,iCAAiB;CAC1C,CAAC","sourcesContent":["import awsClientMandatoryConfig from './rules/aws-client-mandatory-config.js';\nimport awsClientSharedConfig from './rules/aws-client-shared-config.js';\nimport jsxNoDollarInterpolation from './rules/jsx-no-dollar-interpolation.js';\nimport noUnusedSqlBlocks from './rules/no-unused-sql-blocks.js';\n\nexport const rules = {\n  'aws-client-mandatory-config': awsClientMandatoryConfig,\n  'aws-client-shared-config': awsClientSharedConfig,\n  'jsx-no-dollar-interpolation': jsxNoDollarInterpolation,\n  'no-unused-sql-blocks': noUnusedSqlBlocks,\n};\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,2FAA8E;AAC9E,qFAAwE;AACxE,2FAA8E;AAC9E,6EAAgE;AAChE,+DAAmD;AAEtC,QAAA,KAAK,GAAG;IACnB,6BAA6B,EAAE,wCAAwB;IACvD,0BAA0B,EAAE,qCAAqB;IACjD,6BAA6B,EAAE,wCAAwB;IACvD,sBAAsB,EAAE,iCAAiB;IACzC,eAAe,EAAE,0BAAW;CAC7B,CAAC","sourcesContent":["import awsClientMandatoryConfig from './rules/aws-client-mandatory-config.js';\nimport awsClientSharedConfig from './rules/aws-client-shared-config.js';\nimport jsxNoDollarInterpolation from './rules/jsx-no-dollar-interpolation.js';\nimport noUnusedSqlBlocks from './rules/no-unused-sql-blocks.js';\nimport safeDbTypes from './rules/safe-db-types.js';\n\nexport const rules = {\n  'aws-client-mandatory-config': awsClientMandatoryConfig,\n  'aws-client-shared-config': awsClientSharedConfig,\n  'jsx-no-dollar-interpolation': jsxNoDollarInterpolation,\n  'no-unused-sql-blocks': noUnusedSqlBlocks,\n  'safe-db-types': safeDbTypes,\n};\n"]}

package/dist/rules/safe-db-types.d.ts

@@ -0,0 +1,6 @@
+import { ESLintUtils } from '@typescript-eslint/utils';
+declare const _default: ESLintUtils.RuleModule<"unsafeTypes" | "spreadAttributes", [({
+    allowDbTypes?: (string | RegExp)[];
+} | undefined)?], unknown, ESLintUtils.RuleListener>;
+export default _default;
+//# sourceMappingURL=safe-db-types.d.ts.map

package/dist/rules/safe-db-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-db-types.d.ts","sourceRoot":"","sources":["../../src/rules/safe-db-types.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;;mBA0enC,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE;;AADvC,wBAsGG"}

package/dist/rules/safe-db-types.js

@@ -0,0 +1,491 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const utils_1 = require("@typescript-eslint/utils");
+const ts = require("typescript");
+const HYDRATE_FUNCTION_NAME = 'hydrateHtml';
+const HYDRATE_COMPONENT_NAME = 'Hydrate';
+/**
+ * Check if a variable declaration is a Zod schema that uses schemas from db-types.ts
+ * For example: const RubricDataSchema = RubricSchema.extend({...})
+ */
+function checkZodSchemaForDbTypes(declaration, typeChecker) {
+    const violations = [];
+    if (!declaration.initializer)
+        return violations;
+    // Walk the expression tree to find all identifiers
+    const findIdentifiers = (node) => {
+        // Check property access expressions like RubricSchema.extend() or InstanceQuestionSchema.shape
+        if (ts.isPropertyAccessExpression(node)) {
+            const objectSymbol = typeChecker.getSymbolAtLocation(node.expression);
+            if (objectSymbol) {
+                const aliasedSymbol = objectSymbol.flags & ts.SymbolFlags.Alias
+                    ? typeChecker.getAliasedSymbol(objectSymbol)
+                    : objectSymbol;
+                const decls = aliasedSymbol.getDeclarations();
+                if (decls && decls.length > 0) {
+                    const sourceFile = decls[0].getSourceFile();
+                    if (sourceFile.fileName.endsWith('/db-types.ts')) {
+                        violations.push(aliasedSymbol.getName());
+                    }
+                }
+            }
+        }
+        // Check spread elements in object literals (e.g., ...SomeSchema.shape)
+        if (ts.isSpreadAssignment(node)) {
+            // The expression being spread (e.g., SomeSchema.shape)
+            const spreadExpr = node.expression;
+            // Check if it's a property access (e.g., accessing .shape)
+            if (ts.isPropertyAccessExpression(spreadExpr)) {
+                const objectSymbol = typeChecker.getSymbolAtLocation(spreadExpr.expression);
+                if (objectSymbol) {
+                    const aliasedSymbol = objectSymbol.flags & ts.SymbolFlags.Alias
+                        ? typeChecker.getAliasedSymbol(objectSymbol)
+                        : objectSymbol;
+                    const decls = aliasedSymbol.getDeclarations();
+                    if (decls && decls.length > 0) {
+                        const sourceFile = decls[0].getSourceFile();
+                        if (sourceFile.fileName.endsWith('/db-types.ts')) {
+                            violations.push(aliasedSymbol.getName());
+                        }
+                        else {
+                            // The schema is defined locally, check if IT uses db-types
+                            for (const decl of decls) {
+                                if (ts.isVariableDeclaration(decl)) {
+                                    // Recursively check the local schema
+                                    const nestedViolations = checkZodSchemaForDbTypes(decl, typeChecker);
+                                    violations.push(...nestedViolations);
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            // Also check if the spread is a direct identifier (e.g., ...someObject)
+            else if (ts.isIdentifier(spreadExpr)) {
+                const spreadSymbol = typeChecker.getSymbolAtLocation(spreadExpr);
+                if (spreadSymbol) {
+                    const aliasedSymbol = spreadSymbol.flags & ts.SymbolFlags.Alias
+                        ? typeChecker.getAliasedSymbol(spreadSymbol)
+                        : spreadSymbol;
+                    const decls = aliasedSymbol.getDeclarations();
+                    if (decls && decls.length > 0) {
+                        const sourceFile = decls[0].getSourceFile();
+                        if (sourceFile.fileName.endsWith('/db-types.ts')) {
+                            violations.push(aliasedSymbol.getName());
+                        }
+                    }
+                }
+            }
+        }
+        // Check call expressions for arguments
+        if (ts.isCallExpression(node)) {
+            for (const arg of node.arguments) {
+                // Check if argument is an identifier (e.g., RubricItemSchema)
+                if (ts.isIdentifier(arg)) {
+                    const argSymbol = typeChecker.getSymbolAtLocation(arg);
+                    if (argSymbol) {
+                        const aliasedSymbol = argSymbol.flags & ts.SymbolFlags.Alias
+                            ? typeChecker.getAliasedSymbol(argSymbol)
+                            : argSymbol;
+                        const decls = aliasedSymbol.getDeclarations();
+                        if (decls && decls.length > 0) {
+                            const sourceFile = decls[0].getSourceFile();
+                            if (sourceFile.fileName.endsWith('/db-types.ts')) {
+                                violations.push(aliasedSymbol.getName());
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        // Check object literal property assignments (e.g., { rubric: RubricSchema })
+        if (ts.isPropertyAssignment(node) && ts.isIdentifier(node.initializer)) {
+            const identifier = node.initializer;
+            const symbol = typeChecker.getSymbolAtLocation(identifier);
+            if (symbol) {
+                const aliasedSymbol = symbol.flags & ts.SymbolFlags.Alias ? typeChecker.getAliasedSymbol(symbol) : symbol;
+                const decls = aliasedSymbol.getDeclarations();
+                if (decls && decls.length > 0) {
+                    const sourceFile = decls[0].getSourceFile();
+                    if (sourceFile.fileName.endsWith('/db-types.ts')) {
+                        violations.push(aliasedSymbol.getName());
+                    }
+                }
+            }
+        }
+        ts.forEachChild(node, findIdentifiers);
+    };
+    findIdentifiers(declaration.initializer);
+    return violations;
+}
+/**
+ * Check if a type node is z.infer<typeof SchemaName> and if SchemaName uses db-types
+ * Returns the names of db-types that the schema depends on
+ */
+function checkForZodInferPattern(typeNode, typeChecker) {
+    // Check if this is a type reference with type arguments
+    if (!ts.isTypeReferenceNode(typeNode))
+        return [];
+    // Check if the type reference is named (e.g., "infer" from z.infer)
+    const typeName = typeNode.typeName;
+    if (!ts.isQualifiedName(typeName))
+        return [];
+    // Check if it's z.infer or similar pattern
+    // The pattern is: z.infer<typeof SchemaName>
+    const typeArgs = typeNode.typeArguments;
+    if (!typeArgs || typeArgs.length !== 1)
+        return [];
+    const typeArg = typeArgs[0];
+    // Check if the type argument is a typeof expression
+    if (!ts.isTypeQueryNode(typeArg))
+        return [];
+    // Get the schema name from typeof X
+    const exprName = typeArg.exprName;
+    if (!ts.isIdentifier(exprName))
+        return [];
+    // Now find the schema variable declaration
+    const schemaSymbol = typeChecker.getSymbolAtLocation(exprName);
+    if (!schemaSymbol)
+        return [];
+    // Check if this is an imported symbol (alias) - follow it to the original
+    const symbolToCheck = schemaSymbol.flags & ts.SymbolFlags.Alias
+        ? typeChecker.getAliasedSymbol(schemaSymbol)
+        : schemaSymbol;
+    const schemaDecls = symbolToCheck.getDeclarations();
+    if (!schemaDecls || schemaDecls.length === 0)
+        return [];
+    // Check if it's a variable declaration
+    for (const decl of schemaDecls) {
+        if (ts.isVariableDeclaration(decl)) {
+            // If the schema is defined in safe-db-types.ts, it's safe by definition
+            const sourceFile = decl.getSourceFile();
+            if (sourceFile.fileName.endsWith('/safe-db-types.ts')) {
+                return [];
+            }
+            // Use our existing helper to check if the schema uses db-types
+            return checkZodSchemaForDbTypes(decl, typeChecker);
+        }
+    }
+    return [];
+}
+function extractChild(children) {
+    const nonWhitespaceChildren = children.filter((child) => {
+        if (child.type === 'JSXText') {
+            return child.value.trim().length > 0;
+        }
+        return true;
+    });
+    if (nonWhitespaceChildren.length !== 1 || nonWhitespaceChildren[0].type !== 'JSXElement') {
+        return null;
+    }
+    return nonWhitespaceChildren[0];
+}
+/**
+ * Check if a TypeScript type node references a type from db-types.ts
+ * This checks the actual source code type annotation, not the resolved type.
+ * Follows type aliases (imports) to their original declaration.
+ * Returns all unsafe type names found.
+ */
+function checkTypeNodeForDbTypes(typeNode, typeChecker, visited = new Set()) {
+    if (visited.has(typeNode))
+        return [];
+    visited.add(typeNode);
+    const violations = [];
+    // Check type references (e.g., User, Course, AuthnProvider)
+    if (ts.isTypeReferenceNode(typeNode)) {
+        const typeName = typeNode.typeName;
+        const symbol = typeChecker.getSymbolAtLocation(typeName);
+        if (symbol) {
+            // Check if this is an imported symbol (alias) - follow it to the original
+            const symbolToCheck = symbol.flags & ts.SymbolFlags.Alias ? typeChecker.getAliasedSymbol(symbol) : symbol;
+            const declarations = symbolToCheck.getDeclarations();
+            if (declarations && declarations.length > 0) {
+                for (const decl of declarations) {
+                    const sourceFile = decl.getSourceFile();
+                    if (sourceFile.fileName.endsWith('/db-types.ts')) {
+                        // Found a type from db-types.ts!
+                        violations.push(symbolToCheck.getName());
+                    }
+                    else {
+                        // If it's a type alias or interface defined locally, check its properties
+                        if (ts.isTypeAliasDeclaration(decl) && decl.type) {
+                            // Special case: Check if this is z.infer<typeof XxxSchema>
+                            const zodSchemaViolations = checkForZodInferPattern(decl.type, typeChecker);
+                            violations.push(...zodSchemaViolations);
+                            // Also check the type itself
+                            const nestedViolations = checkTypeNodeForDbTypes(decl.type, typeChecker, visited);
+                            violations.push(...nestedViolations);
+                        }
+                        else if (ts.isInterfaceDeclaration(decl)) {
+                            // Check interface members
+                            for (const member of decl.members) {
+                                if (ts.isPropertySignature(member) && member.type) {
+                                    const nestedViolations = checkTypeNodeForDbTypes(member.type, typeChecker, visited);
+                                    violations.push(...nestedViolations);
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        // Check type arguments (e.g., Array<User>, Promise<Course>)
+        if (typeNode.typeArguments) {
+            for (const typeArg of typeNode.typeArguments) {
+                const nestedViolations = checkTypeNodeForDbTypes(typeArg, typeChecker, visited);
+                violations.push(...nestedViolations);
+            }
+        }
+    }
+    // Check array types (e.g., User[])
+    if (ts.isArrayTypeNode(typeNode)) {
+        const nestedViolations = checkTypeNodeForDbTypes(typeNode.elementType, typeChecker, visited);
+        violations.push(...nestedViolations);
+    }
+    // Check union types (e.g., User | null)
+    if (ts.isUnionTypeNode(typeNode)) {
+        for (const type of typeNode.types) {
+            const nestedViolations = checkTypeNodeForDbTypes(type, typeChecker, visited);
+            violations.push(...nestedViolations);
+        }
+    }
+    // Check intersection types (e.g., User & { extra: string })
+    if (ts.isIntersectionTypeNode(typeNode)) {
+        for (const type of typeNode.types) {
+            const nestedViolations = checkTypeNodeForDbTypes(type, typeChecker, visited);
+            violations.push(...nestedViolations);
+        }
+    }
+    // Check object type literals and their properties
+    if (ts.isTypeLiteralNode(typeNode)) {
+        for (const member of typeNode.members) {
+            if (ts.isPropertySignature(member) && member.type) {
+                const nestedViolations = checkTypeNodeForDbTypes(member.type, typeChecker, visited);
+                violations.push(...nestedViolations);
+            }
+        }
+    }
+    // Check indexed access types (e.g., User['name'])
+    // These are safe! We're only extracting a specific property, not passing the whole object.
+    // So we DON'T recurse into the object type for indexed access.
+    if (ts.isIndexedAccessTypeNode(typeNode)) {
+        // Do not check - indexed access is safe
+    }
+    return violations;
+}
+/**
+ * Check if a type name is in the allowlist of safe types
+ */
+function isTypeInAllowlist(typeName, allowlist) {
+    return allowlist.some((pattern) => {
+        if (typeof pattern === 'string') {
+            return typeName === pattern;
+        }
+        return pattern.test(typeName);
+    });
+}
+/**
+ * Check the props of a component for unsafe types from db-types.ts
+ */
+function checkComponentProps(context, typeChecker, componentSymbol, tsComponentNode, jsxElement, reportNode, allowlist) {
+    const childOpeningElement = jsxElement.openingElement;
+    // Get the component's type (function or class component)
+    const componentType = typeChecker.getTypeOfSymbolAtLocation(componentSymbol, tsComponentNode);
+    const signatures = componentType.getCallSignatures();
+    if (signatures.length === 0)
+        return;
+    // Get the first parameter (props) of the component function
+    const propsParam = signatures[0].getParameters()[0];
+    if (!propsParam)
+        return;
+    const propsDeclaration = propsParam.valueDeclaration;
+    if (!propsDeclaration || !ts.isParameter(propsDeclaration))
+        return;
+    // Get the type annotation node from the props parameter
+    const propsTypeNode = propsDeclaration.type;
+    if (!propsTypeNode)
+        return;
+    // Check each property in the props type
+    if (ts.isTypeLiteralNode(propsTypeNode)) {
+        // Inline props object: { foo: string; bar: number }
+        for (const member of propsTypeNode.members) {
+            if (ts.isPropertySignature(member) && member.type && member.name) {
+                if (!ts.isIdentifier(member.name))
+                    continue;
+                const propName = member.name.text;
+                const violations = checkTypeNodeForDbTypes(member.type, typeChecker);
+                if (violations.length > 0) {
+                    // Find the JSX attribute for this prop
+                    const attribute = childOpeningElement.attributes.find((attr) => attr.type === 'JSXAttribute' &&
+                        attr.name.type === 'JSXIdentifier' &&
+                        attr.name.name === propName);
+                    for (const typeName of violations) {
+                        if (isTypeInAllowlist(typeName, allowlist))
+                            continue;
+                        context.report({
+                            node: attribute || reportNode,
+                            messageId: 'unsafeTypes',
+                            data: { propName, typeName },
+                        });
+                    }
+                }
+            }
+        }
+    }
+    else if (ts.isTypeReferenceNode(propsTypeNode)) {
+        // Props is a type reference (e.g., interface or type alias)
+        const symbol = typeChecker.getSymbolAtLocation(propsTypeNode.typeName);
+        if (symbol) {
+            const resolvedSymbol = symbol.flags & ts.SymbolFlags.Alias ? typeChecker.getAliasedSymbol(symbol) : symbol;
+            const declarations = resolvedSymbol.getDeclarations();
+            if (declarations && declarations.length > 0) {
+                for (const decl of declarations) {
+                    if (ts.isInterfaceDeclaration(decl) || ts.isTypeLiteralNode(decl)) {
+                        const members = ts.isInterfaceDeclaration(decl) ? decl.members : decl.members;
+                        for (const member of members) {
+                            if (ts.isPropertySignature(member) && member.type && member.name) {
+                                if (!ts.isIdentifier(member.name))
+                                    continue;
+                                const propName = member.name.text;
+                                const violations = checkTypeNodeForDbTypes(member.type, typeChecker);
+                                if (violations.length > 0) {
+                                    // Find the JSX attribute for this prop
+                                    const attribute = childOpeningElement.attributes.find((attr) => attr.type === 'JSXAttribute' &&
+                                        attr.name.type === 'JSXIdentifier' &&
+                                        attr.name.name === propName);
+                                    for (const typeName of violations) {
+                                        if (isTypeInAllowlist(typeName, allowlist))
+                                            continue;
+                                        context.report({
+                                            node: attribute || reportNode,
+                                            messageId: 'unsafeTypes',
+                                            data: { propName, typeName },
+                                        });
+                                    }
+                                }
+                            }
+                        }
+                    }
+                    else if (ts.isTypeAliasDeclaration(decl) && decl.type) {
+                        // Type alias might be an inline object type
+                        if (ts.isTypeLiteralNode(decl.type)) {
+                            for (const member of decl.type.members) {
+                                if (ts.isPropertySignature(member) && member.type && member.name) {
+                                    if (!ts.isIdentifier(member.name))
+                                        continue;
+                                    const propName = member.name.text;
+                                    const violations = checkTypeNodeForDbTypes(member.type, typeChecker);
+                                    if (violations.length > 0) {
+                                        // Find the JSX attribute for this prop
+                                        const attribute = childOpeningElement.attributes.find((attr) => attr.type === 'JSXAttribute' &&
+                                            attr.name.type === 'JSXIdentifier' &&
+                                            attr.name.name === propName);
+                                        for (const typeName of violations) {
+                                            if (isTypeInAllowlist(typeName, allowlist))
+                                                continue;
+                                            context.report({
+                                                node: attribute || reportNode,
+                                                messageId: 'unsafeTypes',
+                                                data: { propName, typeName },
+                                            });
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+    // Check for spread attributes
+    const attributes = childOpeningElement.attributes;
+    for (const attr of attributes) {
+        if (attr.type === 'JSXSpreadAttribute') {
+            context.report({
+                node: reportNode,
+                messageId: 'spreadAttributes',
+            });
+            continue;
+        }
+    }
+}
+exports.default = utils_1.ESLintUtils.RuleCreator.withoutDocs({
+    meta: {
+        type: 'problem',
+        messages: {
+            spreadAttributes: 'Spread attributes are not allowed in Hydrate children.',
+            unsafeTypes: 'Prop "{{propName}}" uses type "{{typeName}}" which is derived from db-types.ts. Use safe-db-types.ts instead.',
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    allowDbTypes: {
+                        type: 'array',
+                        items: {
+                            type: 'string',
+                        },
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    defaultOptions: [{}],
+    create(context) {
+        const options = context.options[0] || {};
+        const allowlist = options.allowDbTypes || [];
+        return {
+            JSXElement(node) {
+                const openingElementNameExpression = node.openingElement.name;
+                if (openingElementNameExpression.type !== 'JSXIdentifier')
+                    return;
+                const elementName = openingElementNameExpression.name;
+                if (elementName !== HYDRATE_COMPONENT_NAME)
+                    return;
+                const child = extractChild(node.children);
+                if (!child)
+                    return;
+                // Get the component being rendered
+                const childOpeningElement = child.openingElement;
+                const childElementName = childOpeningElement.name;
+                if (childElementName.type !== 'JSXIdentifier')
+                    return;
+                // Get the component's type to inspect its props
+                const services = utils_1.ESLintUtils.getParserServices(context);
+                const typeChecker = services.program.getTypeChecker();
+                const tsChildNode = services.esTreeNodeToTSNodeMap.get(childElementName);
+                const componentSymbol = typeChecker.getSymbolAtLocation(tsChildNode);
+                if (!componentSymbol)
+                    return;
+                checkComponentProps(context, typeChecker, componentSymbol, tsChildNode, child, child, allowlist);
+            },
+            CallExpression(node) {
+                // Check for hydrateHtml(<Component ... />, props?) calls
+                if (node.callee.type !== 'Identifier' || node.callee.name !== HYDRATE_FUNCTION_NAME)
+                    return;
+                // Should have at least one argument, the first is JSX element.
+                if (node.arguments.length === 0)
+                    return;
+                const arg = node.arguments[0];
+                if (arg.type !== 'JSXElement')
+                    return;
+                const jsxElement = arg;
+                const openingElement = jsxElement.openingElement;
+                const elementName = openingElement.name;
+                if (elementName.type !== 'JSXIdentifier')
+                    return;
+                // Get the component's type to inspect its props
+                const services = utils_1.ESLintUtils.getParserServices(context);
+                const typeChecker = services.program.getTypeChecker();
+                const tsElementNode = services.esTreeNodeToTSNodeMap.get(elementName);
+                const componentSymbol = typeChecker.getSymbolAtLocation(tsElementNode);
+                if (!componentSymbol)
+                    return;
+                checkComponentProps(context, typeChecker, componentSymbol, tsElementNode, jsxElement, node, allowlist);
+            },
+        };
+    },
+});
+//# sourceMappingURL=safe-db-types.js.map

package/dist/rules/safe-db-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-db-types.js","sourceRoot":"","sources":["../../src/rules/safe-db-types.ts"],"names":[],"mappings":";;AACA,oDAAuD;AACvD,iCAAiC;AAEjC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAC5C,MAAM,sBAAsB,GAAG,SAAS,CAAC;AAEzC;;;GAGG;AACH,SAAS,wBAAwB,CAC/B,WAAmC,EACnC,WAA2B;IAE3B,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,IAAI,CAAC,WAAW,CAAC,WAAW;QAAE,OAAO,UAAU,CAAC;IAEhD,mDAAmD;IACnD,MAAM,eAAe,GAAG,CAAC,IAAa,EAAQ,EAAE;QAC9C,+FAA+F;QAC/F,IAAI,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,YAAY,GAAG,WAAW,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtE,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,aAAa,GACjB,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK;oBACvC,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC;oBAC5C,CAAC,CAAC,YAAY,CAAC;gBACnB,MAAM,KAAK,GAAG,aAAa,CAAC,eAAe,EAAE,CAAC;gBAC9C,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC9B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;oBAC5C,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;wBACjD,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC3C,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,IAAI,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,uDAAuD;YACvD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YAEnC,2DAA2D;YAC3D,IAAI,EAAE,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9C,MAAM,YAAY,GAAG,WAAW,CAAC,mBAAmB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;gBAC5E,IAAI,YAAY,EAAE,CAAC;oBACjB,MAAM,aAAa,GACjB,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK;wBACvC,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC;wBAC5C,CAAC,CAAC,YAAY,CAAC;oBACnB,MAAM,KAAK,GAAG,aAAa,CAAC,eAAe,EAAE,CAAC;oBAC9C,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAC9B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;wBAC5C,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;4BACjD,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC;wBAC3C,CAAC;6BAAM,CAAC;4BACN,2DAA2D;4BAC3D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gCACzB,IAAI,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;oCACnC,qCAAqC;oCACrC,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;oCACrE,UAAU,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAC;gCACvC,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,wEAAwE;iBACnE,IAAI,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;gBACrC,MAAM,YAAY,GAAG,WAAW,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;gBACjE,IAAI,YAAY,EAAE,CAAC;oBACjB,MAAM,aAAa,GACjB,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK;wBACvC,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC;wBAC5C,CAAC,CAAC,YAAY,CAAC;oBACnB,MAAM,KAAK,GAAG,aAAa,CAAC,eAAe,EAAE,CAAC;oBAC9C,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAC9B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;wBAC5C,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;4BACjD,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC;wBAC3C,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,uCAAuC;QACvC,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACjC,8DAA8D;gBAC9D,IAAI,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,MAAM,SAAS,GAAG,WAAW,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;oBACvD,IAAI,SAAS,EAAE,CAAC;wBACd,MAAM,aAAa,GACjB,SAAS,CAAC,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK;4BACpC,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC,SAAS,CAAC;4BACzC,CAAC,CAAC,SAAS,CAAC;wBAChB,MAAM,KAAK,GAAG,aAAa,CAAC,eAAe,EAAE,CAAC;wBAC9C,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BAC9B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;4BAC5C,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gCACjD,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC;4BAC3C,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,6EAA6E;QAC7E,IAAI,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACvE,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC;YACpC,MAAM,MAAM,GAAG,WAAW,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;YAC3D,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,aAAa,GACjB,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBACtF,MAAM,KAAK,GAAG,aAAa,CAAC,eAAe,EAAE,CAAC;gBAC9C,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC9B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;oBAC5C,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;wBACjD,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC3C,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACzC,CAAC,CAAC;IAEF,eAAe,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IACzC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAAC,QAAqB,EAAE,WAA2B;IACjF,wDAAwD;IACxD,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAEjD,oEAAoE;IACpE,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;IACnC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAE7C,2CAA2C;IAC3C,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,aAAa,CAAC;IACxC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAElD,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAE5B,oDAAoD;IACpD,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAE5C,oCAAoC;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAE1C,2CAA2C;IAC3C,MAAM,YAAY,GAAG,WAAW,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IAE7B,0EAA0E;IAC1E,MAAM,aAAa,GACjB,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK;QACvC,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC;QAC5C,CAAC,CAAC,YAAY,CAAC;IAEnB,MAAM,WAAW,GAAG,aAAa,CAAC,eAAe,EAAE,CAAC;IACpD,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAExD,uCAAuC;IACvC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,wEAAwE;YACxE,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;YACxC,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACtD,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,+DAA+D;YAC/D,OAAO,wBAAwB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,YAAY,CAAC,QAA6B;IACjD,MAAM,qBAAqB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACtD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,IAAI,qBAAqB,CAAC,MAAM,KAAK,CAAC,IAAI,qBAAqB,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACzF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,qBAAqB,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAC9B,QAAqB,EACrB,WAA2B,EAC3B,UAAU,IAAI,GAAG,EAAe;IAEhC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAEtB,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,4DAA4D;IAC5D,IAAI,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACnC,MAAM,MAAM,GAAG,WAAW,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAEzD,IAAI,MAAM,EAAE,CAAC;YACX,0EAA0E;YAC1E,MAAM,aAAa,GACjB,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAEtF,MAAM,YAAY,GAAG,aAAa,CAAC,eAAe,EAAE,CAAC;YACrD,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5C,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;oBAChC,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;oBACxC,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;wBACjD,iCAAiC;wBACjC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC3C,CAAC;yBAAM,CAAC;wBACN,0EAA0E;wBAC1E,IAAI,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;4BACjD,2DAA2D;4BAC3D,MAAM,mBAAmB,GAAG,uBAAuB,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;4BAC5E,UAAU,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,CAAC;4BAExC,6BAA6B;4BAC7B,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;4BAClF,UAAU,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAC;wBACvC,CAAC;6BAAM,IAAI,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;4BAC3C,0BAA0B;4BAC1B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gCAClC,IAAI,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;oCAClD,MAAM,gBAAgB,GAAG,uBAAuB,CAC9C,MAAM,CAAC,IAAI,EACX,WAAW,EACX,OAAO,CACR,CAAC;oCACF,UAAU,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAC;gCACvC,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,4DAA4D;QAC5D,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;YAC3B,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;gBAC7C,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;gBAChF,UAAU,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,IAAI,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QAC7F,UAAU,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAC;IACvC,CAAC;IAED,wCAAwC;IACxC,IAAI,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;YAC7E,UAAU,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,IAAI,EAAE,CAAC,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;YAC7E,UAAU,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,IAAI,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtC,IAAI,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAClD,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;gBACpF,UAAU,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,2FAA2F;IAC3F,+DAA+D;IAC/D,IAAI,EAAE,CAAC,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,wCAAwC;IAC1C,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,QAAgB,EAAE,SAA8B;IACzE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAChC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,QAAQ,KAAK,OAAO,CAAC;QAC9B,CAAC;QACD,OAAO,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,OAIS,EACT,WAA2B,EAC3B,eAA0B,EAC1B,eAAwB,EACxB,UAA+B,EAC/B,UAAyB,EACzB,SAA8B;IAE9B,MAAM,mBAAmB,GAAG,UAAU,CAAC,cAAc,CAAC;IAEtD,yDAAyD;IACzD,MAAM,aAAa,GAAG,WAAW,CAAC,yBAAyB,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAC9F,MAAM,UAAU,GAAG,aAAa,CAAC,iBAAiB,EAAE,CAAC;IAErD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEpC,4DAA4D;IAC5D,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU;QAAE,OAAO;IAExB,MAAM,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;IAErD,IAAI,CAAC,gBAAgB,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,gBAAgB,CAAC;QAAE,OAAO;IAEnE,wDAAwD;IACxD,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC;IAC5C,IAAI,CAAC,aAAa;QAAE,OAAO;IAE3B,wCAAwC;IACxC,IAAI,EAAE,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAAE,CAAC;QACxC,oDAAoD;QACpD,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;YAC3C,IAAI,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjE,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAE5C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;gBAClC,MAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;gBAErE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1B,uCAAuC;oBACvC,MAAM,SAAS,GAAG,mBAAmB,CAAC,UAAU,CAAC,IAAI,CACnD,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,IAAI,KAAK,cAAc;wBAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,eAAe;wBAClC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAC9B,CAAC;oBAEF,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;wBAClC,IAAI,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC;4BAAE,SAAS;wBAErD,OAAO,CAAC,MAAM,CAAC;4BACb,IAAI,EAAE,SAAS,IAAI,UAAU;4BAC7B,SAAS,EAAE,aAAa;4BACxB,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;yBAC7B,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,EAAE,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAAE,CAAC;QACjD,4DAA4D;QAC5D,MAAM,MAAM,GAAG,WAAW,CAAC,mBAAmB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,cAAc,GAClB,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YACtF,MAAM,YAAY,GAAG,cAAc,CAAC,eAAe,EAAE,CAAC;YAEtD,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5C,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;oBAChC,IAAI,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;wBAClE,MAAM,OAAO,GAAG,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;wBAE9E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;4BAC7B,IAAI,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gCACjE,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC;oCAAE,SAAS;gCAE5C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;gCAClC,MAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;gCAErE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oCAC1B,uCAAuC;oCACvC,MAAM,SAAS,GAAG,mBAAmB,CAAC,UAAU,CAAC,IAAI,CACnD,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,IAAI,KAAK,cAAc;wCAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,eAAe;wCAClC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAC9B,CAAC;oCAEF,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;wCAClC,IAAI,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC;4CAAE,SAAS;wCAErD,OAAO,CAAC,MAAM,CAAC;4CACb,IAAI,EAAE,SAAS,IAAI,UAAU;4CAC7B,SAAS,EAAE,aAAa;4CACxB,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;yCAC7B,CAAC,CAAC;oCACL,CAAC;gCACH,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;yBAAM,IAAI,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;wBACxD,4CAA4C;wBAC5C,IAAI,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;4BACpC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gCACvC,IAAI,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;oCACjE,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC;wCAAE,SAAS;oCAE5C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;oCAClC,MAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;oCAErE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wCAC1B,uCAAuC;wCACvC,MAAM,SAAS,GAAG,mBAAmB,CAAC,UAAU,CAAC,IAAI,CACnD,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,IAAI,KAAK,cAAc;4CAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,eAAe;4CAClC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAC9B,CAAC;wCAEF,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;4CAClC,IAAI,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC;gDAAE,SAAS;4CAErD,OAAO,CAAC,MAAM,CAAC;gDACb,IAAI,EAAE,SAAS,IAAI,UAAU;gDAC7B,SAAS,EAAE,aAAa;gDACxB,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;6CAC7B,CAAC,CAAC;wCACL,CAAC;oCACH,CAAC;gCACH,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,MAAM,UAAU,GAAG,mBAAmB,CAAC,UAAU,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YACvC,OAAO,CAAC,MAAM,CAAC;gBACb,IAAI,EAAE,UAAU;gBAChB,SAAS,EAAE,kBAAkB;aAC9B,CAAC,CAAC;YACH,SAAS;QACX,CAAC;IACH,CAAC;AACH,CAAC;AAED,kBAAe,mBAAW,CAAC,WAAW,CAAC,WAAW,CAGhD;IACA,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE;YACR,gBAAgB,EAAE,wDAAwD;YAC1E,WAAW,EACT,+GAA+G;SAClH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,YAAY,EAAE;wBACZ,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE;4BACL,IAAI,EAAE,QAAQ;yBACf;qBACF;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE,CAAC,EAAE,CAAC;IACpB,MAAM,CAAC,OAAO;QACZ,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;QAC7C,OAAO;YACL,UAAU,CAAC,IAAI;gBACb,MAAM,4BAA4B,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;gBAC9D,IAAI,4BAA4B,CAAC,IAAI,KAAK,eAAe;oBAAE,OAAO;gBAElE,MAAM,WAAW,GAAG,4BAA4B,CAAC,IAAI,CAAC;gBACtD,IAAI,WAAW,KAAK,sBAAsB;oBAAE,OAAO;gBAEnD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC1C,IAAI,CAAC,KAAK;oBAAE,OAAO;gBAEnB,mCAAmC;gBACnC,MAAM,mBAAmB,GAAG,KAAK,CAAC,cAAc,CAAC;gBACjD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,IAAI,CAAC;gBAElD,IAAI,gBAAgB,CAAC,IAAI,KAAK,eAAe;oBAAE,OAAO;gBAEtD,gDAAgD;gBAChD,MAAM,QAAQ,GAAG,mBAAW,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;gBACxD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;gBACtD,MAAM,WAAW,GAAG,QAAQ,CAAC,qBAAqB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBACzE,MAAM,eAAe,GAAG,WAAW,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;gBAErE,IAAI,CAAC,eAAe;oBAAE,OAAO;gBAE7B,mBAAmB,CACjB,OAAO,EACP,WAAW,EACX,eAAe,EACf,WAAW,EACX,KAAK,EACL,KAAK,EACL,SAAS,CACV,CAAC;YACJ,CAAC;YAED,cAAc,CAAC,IAAI;gBACjB,yDAAyD;gBACzD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,qBAAqB;oBAAE,OAAO;gBAE5F,+DAA+D;gBAC/D,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO;gBAExC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBAC9B,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY;oBAAE,OAAO;gBAEtC,MAAM,UAAU,GAAG,GAAG,CAAC;gBACvB,MAAM,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;gBACjD,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC;gBAExC,IAAI,WAAW,CAAC,IAAI,KAAK,eAAe;oBAAE,OAAO;gBAEjD,gDAAgD;gBAChD,MAAM,QAAQ,GAAG,mBAAW,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;gBACxD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;gBACtD,MAAM,aAAa,GAAG,QAAQ,CAAC,qBAAqB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACtE,MAAM,eAAe,GAAG,WAAW,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC;gBAEvE,IAAI,CAAC,eAAe;oBAAE,OAAO;gBAE7B,mBAAmB,CACjB,OAAO,EACP,WAAW,EACX,eAAe,EACf,aAAa,EACb,UAAU,EACV,IAAI,EACJ,SAAS,CACV,CAAC;YACJ,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { type TSESTree } from '@typescript-eslint/types';\nimport { ESLintUtils } from '@typescript-eslint/utils';\nimport * as ts from 'typescript';\n\nconst HYDRATE_FUNCTION_NAME = 'hydrateHtml';\nconst HYDRATE_COMPONENT_NAME = 'Hydrate';\n\n/**\n * Check if a variable declaration is a Zod schema that uses schemas from db-types.ts\n * For example: const RubricDataSchema = RubricSchema.extend({...})\n */\nfunction checkZodSchemaForDbTypes(\n  declaration: ts.VariableDeclaration,\n  typeChecker: ts.TypeChecker,\n): string[] {\n  const violations: string[] = [];\n\n  if (!declaration.initializer) return violations;\n\n  // Walk the expression tree to find all identifiers\n  const findIdentifiers = (node: ts.Node): void => {\n    // Check property access expressions like RubricSchema.extend() or InstanceQuestionSchema.shape\n    if (ts.isPropertyAccessExpression(node)) {\n      const objectSymbol = typeChecker.getSymbolAtLocation(node.expression);\n      if (objectSymbol) {\n        const aliasedSymbol =\n          objectSymbol.flags & ts.SymbolFlags.Alias\n            ? typeChecker.getAliasedSymbol(objectSymbol)\n            : objectSymbol;\n        const decls = aliasedSymbol.getDeclarations();\n        if (decls && decls.length > 0) {\n          const sourceFile = decls[0].getSourceFile();\n          if (sourceFile.fileName.endsWith('/db-types.ts')) {\n            violations.push(aliasedSymbol.getName());\n          }\n        }\n      }\n    }\n\n    // Check spread elements in object literals (e.g., ...SomeSchema.shape)\n    if (ts.isSpreadAssignment(node)) {\n      // The expression being spread (e.g., SomeSchema.shape)\n      const spreadExpr = node.expression;\n\n      // Check if it's a property access (e.g., accessing .shape)\n      if (ts.isPropertyAccessExpression(spreadExpr)) {\n        const objectSymbol = typeChecker.getSymbolAtLocation(spreadExpr.expression);\n        if (objectSymbol) {\n          const aliasedSymbol =\n            objectSymbol.flags & ts.SymbolFlags.Alias\n              ? typeChecker.getAliasedSymbol(objectSymbol)\n              : objectSymbol;\n          const decls = aliasedSymbol.getDeclarations();\n          if (decls && decls.length > 0) {\n            const sourceFile = decls[0].getSourceFile();\n            if (sourceFile.fileName.endsWith('/db-types.ts')) {\n              violations.push(aliasedSymbol.getName());\n            } else {\n              // The schema is defined locally, check if IT uses db-types\n              for (const decl of decls) {\n                if (ts.isVariableDeclaration(decl)) {\n                  // Recursively check the local schema\n                  const nestedViolations = checkZodSchemaForDbTypes(decl, typeChecker);\n                  violations.push(...nestedViolations);\n                }\n              }\n            }\n          }\n        }\n      }\n      // Also check if the spread is a direct identifier (e.g., ...someObject)\n      else if (ts.isIdentifier(spreadExpr)) {\n        const spreadSymbol = typeChecker.getSymbolAtLocation(spreadExpr);\n        if (spreadSymbol) {\n          const aliasedSymbol =\n            spreadSymbol.flags & ts.SymbolFlags.Alias\n              ? typeChecker.getAliasedSymbol(spreadSymbol)\n              : spreadSymbol;\n          const decls = aliasedSymbol.getDeclarations();\n          if (decls && decls.length > 0) {\n            const sourceFile = decls[0].getSourceFile();\n            if (sourceFile.fileName.endsWith('/db-types.ts')) {\n              violations.push(aliasedSymbol.getName());\n            }\n          }\n        }\n      }\n    }\n\n    // Check call expressions for arguments\n    if (ts.isCallExpression(node)) {\n      for (const arg of node.arguments) {\n        // Check if argument is an identifier (e.g., RubricItemSchema)\n        if (ts.isIdentifier(arg)) {\n          const argSymbol = typeChecker.getSymbolAtLocation(arg);\n          if (argSymbol) {\n            const aliasedSymbol =\n              argSymbol.flags & ts.SymbolFlags.Alias\n                ? typeChecker.getAliasedSymbol(argSymbol)\n                : argSymbol;\n            const decls = aliasedSymbol.getDeclarations();\n            if (decls && decls.length > 0) {\n              const sourceFile = decls[0].getSourceFile();\n              if (sourceFile.fileName.endsWith('/db-types.ts')) {\n                violations.push(aliasedSymbol.getName());\n              }\n            }\n          }\n        }\n      }\n    }\n\n    // Check object literal property assignments (e.g., { rubric: RubricSchema })\n    if (ts.isPropertyAssignment(node) && ts.isIdentifier(node.initializer)) {\n      const identifier = node.initializer;\n      const symbol = typeChecker.getSymbolAtLocation(identifier);\n      if (symbol) {\n        const aliasedSymbol =\n          symbol.flags & ts.SymbolFlags.Alias ? typeChecker.getAliasedSymbol(symbol) : symbol;\n        const decls = aliasedSymbol.getDeclarations();\n        if (decls && decls.length > 0) {\n          const sourceFile = decls[0].getSourceFile();\n          if (sourceFile.fileName.endsWith('/db-types.ts')) {\n            violations.push(aliasedSymbol.getName());\n          }\n        }\n      }\n    }\n\n    ts.forEachChild(node, findIdentifiers);\n  };\n\n  findIdentifiers(declaration.initializer);\n  return violations;\n}\n\n/**\n * Check if a type node is z.infer<typeof SchemaName> and if SchemaName uses db-types\n * Returns the names of db-types that the schema depends on\n */\nfunction checkForZodInferPattern(typeNode: ts.TypeNode, typeChecker: ts.TypeChecker): string[] {\n  // Check if this is a type reference with type arguments\n  if (!ts.isTypeReferenceNode(typeNode)) return [];\n\n  // Check if the type reference is named (e.g., \"infer\" from z.infer)\n  const typeName = typeNode.typeName;\n  if (!ts.isQualifiedName(typeName)) return [];\n\n  // Check if it's z.infer or similar pattern\n  // The pattern is: z.infer<typeof SchemaName>\n  const typeArgs = typeNode.typeArguments;\n  if (!typeArgs || typeArgs.length !== 1) return [];\n\n  const typeArg = typeArgs[0];\n\n  // Check if the type argument is a typeof expression\n  if (!ts.isTypeQueryNode(typeArg)) return [];\n\n  // Get the schema name from typeof X\n  const exprName = typeArg.exprName;\n  if (!ts.isIdentifier(exprName)) return [];\n\n  // Now find the schema variable declaration\n  const schemaSymbol = typeChecker.getSymbolAtLocation(exprName);\n  if (!schemaSymbol) return [];\n\n  // Check if this is an imported symbol (alias) - follow it to the original\n  const symbolToCheck =\n    schemaSymbol.flags & ts.SymbolFlags.Alias\n      ? typeChecker.getAliasedSymbol(schemaSymbol)\n      : schemaSymbol;\n\n  const schemaDecls = symbolToCheck.getDeclarations();\n  if (!schemaDecls || schemaDecls.length === 0) return [];\n\n  // Check if it's a variable declaration\n  for (const decl of schemaDecls) {\n    if (ts.isVariableDeclaration(decl)) {\n      // If the schema is defined in safe-db-types.ts, it's safe by definition\n      const sourceFile = decl.getSourceFile();\n      if (sourceFile.fileName.endsWith('/safe-db-types.ts')) {\n        return [];\n      }\n\n      // Use our existing helper to check if the schema uses db-types\n      return checkZodSchemaForDbTypes(decl, typeChecker);\n    }\n  }\n\n  return [];\n}\n\nfunction extractChild(children: TSESTree.JSXChild[]): TSESTree.JSXElement | null {\n  const nonWhitespaceChildren = children.filter((child) => {\n    if (child.type === 'JSXText') {\n      return child.value.trim().length > 0;\n    }\n    return true;\n  });\n\n  if (nonWhitespaceChildren.length !== 1 || nonWhitespaceChildren[0].type !== 'JSXElement') {\n    return null;\n  }\n\n  return nonWhitespaceChildren[0];\n}\n\n/**\n * Check if a TypeScript type node references a type from db-types.ts\n * This checks the actual source code type annotation, not the resolved type.\n * Follows type aliases (imports) to their original declaration.\n * Returns all unsafe type names found.\n */\nfunction checkTypeNodeForDbTypes(\n  typeNode: ts.TypeNode,\n  typeChecker: ts.TypeChecker,\n  visited = new Set<ts.TypeNode>(),\n): string[] {\n  if (visited.has(typeNode)) return [];\n  visited.add(typeNode);\n\n  const violations: string[] = [];\n\n  // Check type references (e.g., User, Course, AuthnProvider)\n  if (ts.isTypeReferenceNode(typeNode)) {\n    const typeName = typeNode.typeName;\n    const symbol = typeChecker.getSymbolAtLocation(typeName);\n\n    if (symbol) {\n      // Check if this is an imported symbol (alias) - follow it to the original\n      const symbolToCheck =\n        symbol.flags & ts.SymbolFlags.Alias ? typeChecker.getAliasedSymbol(symbol) : symbol;\n\n      const declarations = symbolToCheck.getDeclarations();\n      if (declarations && declarations.length > 0) {\n        for (const decl of declarations) {\n          const sourceFile = decl.getSourceFile();\n          if (sourceFile.fileName.endsWith('/db-types.ts')) {\n            // Found a type from db-types.ts!\n            violations.push(symbolToCheck.getName());\n          } else {\n            // If it's a type alias or interface defined locally, check its properties\n            if (ts.isTypeAliasDeclaration(decl) && decl.type) {\n              // Special case: Check if this is z.infer<typeof XxxSchema>\n              const zodSchemaViolations = checkForZodInferPattern(decl.type, typeChecker);\n              violations.push(...zodSchemaViolations);\n\n              // Also check the type itself\n              const nestedViolations = checkTypeNodeForDbTypes(decl.type, typeChecker, visited);\n              violations.push(...nestedViolations);\n            } else if (ts.isInterfaceDeclaration(decl)) {\n              // Check interface members\n              for (const member of decl.members) {\n                if (ts.isPropertySignature(member) && member.type) {\n                  const nestedViolations = checkTypeNodeForDbTypes(\n                    member.type,\n                    typeChecker,\n                    visited,\n                  );\n                  violations.push(...nestedViolations);\n                }\n              }\n            }\n          }\n        }\n      }\n    }\n\n    // Check type arguments (e.g., Array<User>, Promise<Course>)\n    if (typeNode.typeArguments) {\n      for (const typeArg of typeNode.typeArguments) {\n        const nestedViolations = checkTypeNodeForDbTypes(typeArg, typeChecker, visited);\n        violations.push(...nestedViolations);\n      }\n    }\n  }\n\n  // Check array types (e.g., User[])\n  if (ts.isArrayTypeNode(typeNode)) {\n    const nestedViolations = checkTypeNodeForDbTypes(typeNode.elementType, typeChecker, visited);\n    violations.push(...nestedViolations);\n  }\n\n  // Check union types (e.g., User | null)\n  if (ts.isUnionTypeNode(typeNode)) {\n    for (const type of typeNode.types) {\n      const nestedViolations = checkTypeNodeForDbTypes(type, typeChecker, visited);\n      violations.push(...nestedViolations);\n    }\n  }\n\n  // Check intersection types (e.g., User & { extra: string })\n  if (ts.isIntersectionTypeNode(typeNode)) {\n    for (const type of typeNode.types) {\n      const nestedViolations = checkTypeNodeForDbTypes(type, typeChecker, visited);\n      violations.push(...nestedViolations);\n    }\n  }\n\n  // Check object type literals and their properties\n  if (ts.isTypeLiteralNode(typeNode)) {\n    for (const member of typeNode.members) {\n      if (ts.isPropertySignature(member) && member.type) {\n        const nestedViolations = checkTypeNodeForDbTypes(member.type, typeChecker, visited);\n        violations.push(...nestedViolations);\n      }\n    }\n  }\n\n  // Check indexed access types (e.g., User['name'])\n  // These are safe! We're only extracting a specific property, not passing the whole object.\n  // So we DON'T recurse into the object type for indexed access.\n  if (ts.isIndexedAccessTypeNode(typeNode)) {\n    // Do not check - indexed access is safe\n  }\n\n  return violations;\n}\n\n/**\n * Check if a type name is in the allowlist of safe types\n */\nfunction isTypeInAllowlist(typeName: string, allowlist: (string | RegExp)[]): boolean {\n  return allowlist.some((pattern) => {\n    if (typeof pattern === 'string') {\n      return typeName === pattern;\n    }\n    return pattern.test(typeName);\n  });\n}\n\n/**\n * Check the props of a component for unsafe types from db-types.ts\n */\nfunction checkComponentProps(\n  context: ReturnType<typeof ESLintUtils.RuleCreator.withoutDocs>['create'] extends (\n    context: infer C,\n  ) => any\n    ? C\n    : never,\n  typeChecker: ts.TypeChecker,\n  componentSymbol: ts.Symbol,\n  tsComponentNode: ts.Node,\n  jsxElement: TSESTree.JSXElement,\n  reportNode: TSESTree.Node,\n  allowlist: (string | RegExp)[],\n): void {\n  const childOpeningElement = jsxElement.openingElement;\n\n  // Get the component's type (function or class component)\n  const componentType = typeChecker.getTypeOfSymbolAtLocation(componentSymbol, tsComponentNode);\n  const signatures = componentType.getCallSignatures();\n\n  if (signatures.length === 0) return;\n\n  // Get the first parameter (props) of the component function\n  const propsParam = signatures[0].getParameters()[0];\n  if (!propsParam) return;\n\n  const propsDeclaration = propsParam.valueDeclaration;\n\n  if (!propsDeclaration || !ts.isParameter(propsDeclaration)) return;\n\n  // Get the type annotation node from the props parameter\n  const propsTypeNode = propsDeclaration.type;\n  if (!propsTypeNode) return;\n\n  // Check each property in the props type\n  if (ts.isTypeLiteralNode(propsTypeNode)) {\n    // Inline props object: { foo: string; bar: number }\n    for (const member of propsTypeNode.members) {\n      if (ts.isPropertySignature(member) && member.type && member.name) {\n        if (!ts.isIdentifier(member.name)) continue;\n\n        const propName = member.name.text;\n        const violations = checkTypeNodeForDbTypes(member.type, typeChecker);\n\n        if (violations.length > 0) {\n          // Find the JSX attribute for this prop\n          const attribute = childOpeningElement.attributes.find(\n            (attr) =>\n              attr.type === 'JSXAttribute' &&\n              attr.name.type === 'JSXIdentifier' &&\n              attr.name.name === propName,\n          );\n\n          for (const typeName of violations) {\n            if (isTypeInAllowlist(typeName, allowlist)) continue;\n\n            context.report({\n              node: attribute || reportNode,\n              messageId: 'unsafeTypes',\n              data: { propName, typeName },\n            });\n          }\n        }\n      }\n    }\n  } else if (ts.isTypeReferenceNode(propsTypeNode)) {\n    // Props is a type reference (e.g., interface or type alias)\n    const symbol = typeChecker.getSymbolAtLocation(propsTypeNode.typeName);\n    if (symbol) {\n      const resolvedSymbol =\n        symbol.flags & ts.SymbolFlags.Alias ? typeChecker.getAliasedSymbol(symbol) : symbol;\n      const declarations = resolvedSymbol.getDeclarations();\n\n      if (declarations && declarations.length > 0) {\n        for (const decl of declarations) {\n          if (ts.isInterfaceDeclaration(decl) || ts.isTypeLiteralNode(decl)) {\n            const members = ts.isInterfaceDeclaration(decl) ? decl.members : decl.members;\n\n            for (const member of members) {\n              if (ts.isPropertySignature(member) && member.type && member.name) {\n                if (!ts.isIdentifier(member.name)) continue;\n\n                const propName = member.name.text;\n                const violations = checkTypeNodeForDbTypes(member.type, typeChecker);\n\n                if (violations.length > 0) {\n                  // Find the JSX attribute for this prop\n                  const attribute = childOpeningElement.attributes.find(\n                    (attr) =>\n                      attr.type === 'JSXAttribute' &&\n                      attr.name.type === 'JSXIdentifier' &&\n                      attr.name.name === propName,\n                  );\n\n                  for (const typeName of violations) {\n                    if (isTypeInAllowlist(typeName, allowlist)) continue;\n\n                    context.report({\n                      node: attribute || reportNode,\n                      messageId: 'unsafeTypes',\n                      data: { propName, typeName },\n                    });\n                  }\n                }\n              }\n            }\n          } else if (ts.isTypeAliasDeclaration(decl) && decl.type) {\n            // Type alias might be an inline object type\n            if (ts.isTypeLiteralNode(decl.type)) {\n              for (const member of decl.type.members) {\n                if (ts.isPropertySignature(member) && member.type && member.name) {\n                  if (!ts.isIdentifier(member.name)) continue;\n\n                  const propName = member.name.text;\n                  const violations = checkTypeNodeForDbTypes(member.type, typeChecker);\n\n                  if (violations.length > 0) {\n                    // Find the JSX attribute for this prop\n                    const attribute = childOpeningElement.attributes.find(\n                      (attr) =>\n                        attr.type === 'JSXAttribute' &&\n                        attr.name.type === 'JSXIdentifier' &&\n                        attr.name.name === propName,\n                    );\n\n                    for (const typeName of violations) {\n                      if (isTypeInAllowlist(typeName, allowlist)) continue;\n\n                      context.report({\n                        node: attribute || reportNode,\n                        messageId: 'unsafeTypes',\n                        data: { propName, typeName },\n                      });\n                    }\n                  }\n                }\n              }\n            }\n          }\n        }\n      }\n    }\n  }\n\n  // Check for spread attributes\n  const attributes = childOpeningElement.attributes;\n  for (const attr of attributes) {\n    if (attr.type === 'JSXSpreadAttribute') {\n      context.report({\n        node: reportNode,\n        messageId: 'spreadAttributes',\n      });\n      continue;\n    }\n  }\n}\n\nexport default ESLintUtils.RuleCreator.withoutDocs<\n  [{ allowDbTypes?: (string | RegExp)[] }?],\n  'spreadAttributes' | 'unsafeTypes'\n>({\n  meta: {\n    type: 'problem',\n    messages: {\n      spreadAttributes: 'Spread attributes are not allowed in Hydrate children.',\n      unsafeTypes:\n        'Prop \"{{propName}}\" uses type \"{{typeName}}\" which is derived from db-types.ts. Use safe-db-types.ts instead.',\n    },\n    schema: [\n      {\n        type: 'object',\n        properties: {\n          allowDbTypes: {\n            type: 'array',\n            items: {\n              type: 'string',\n            },\n          },\n        },\n        additionalProperties: false,\n      },\n    ],\n  },\n  defaultOptions: [{}],\n  create(context) {\n    const options = context.options[0] || {};\n    const allowlist = options.allowDbTypes || [];\n    return {\n      JSXElement(node) {\n        const openingElementNameExpression = node.openingElement.name;\n        if (openingElementNameExpression.type !== 'JSXIdentifier') return;\n\n        const elementName = openingElementNameExpression.name;\n        if (elementName !== HYDRATE_COMPONENT_NAME) return;\n\n        const child = extractChild(node.children);\n        if (!child) return;\n\n        // Get the component being rendered\n        const childOpeningElement = child.openingElement;\n        const childElementName = childOpeningElement.name;\n\n        if (childElementName.type !== 'JSXIdentifier') return;\n\n        // Get the component's type to inspect its props\n        const services = ESLintUtils.getParserServices(context);\n        const typeChecker = services.program.getTypeChecker();\n        const tsChildNode = services.esTreeNodeToTSNodeMap.get(childElementName);\n        const componentSymbol = typeChecker.getSymbolAtLocation(tsChildNode);\n\n        if (!componentSymbol) return;\n\n        checkComponentProps(\n          context,\n          typeChecker,\n          componentSymbol,\n          tsChildNode,\n          child,\n          child,\n          allowlist,\n        );\n      },\n\n      CallExpression(node) {\n        // Check for hydrateHtml(<Component ... />, props?) calls\n        if (node.callee.type !== 'Identifier' || node.callee.name !== HYDRATE_FUNCTION_NAME) return;\n\n        // Should have at least one argument, the first is JSX element.\n        if (node.arguments.length === 0) return;\n\n        const arg = node.arguments[0];\n        if (arg.type !== 'JSXElement') return;\n\n        const jsxElement = arg;\n        const openingElement = jsxElement.openingElement;\n        const elementName = openingElement.name;\n\n        if (elementName.type !== 'JSXIdentifier') return;\n\n        // Get the component's type to inspect its props\n        const services = ESLintUtils.getParserServices(context);\n        const typeChecker = services.program.getTypeChecker();\n        const tsElementNode = services.esTreeNodeToTSNodeMap.get(elementName);\n        const componentSymbol = typeChecker.getSymbolAtLocation(tsElementNode);\n\n        if (!componentSymbol) return;\n\n        checkComponentProps(\n          context,\n          typeChecker,\n          componentSymbol,\n          tsElementNode,\n          jsxElement,\n          node,\n          allowlist,\n        );\n      },\n    };\n  },\n});\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prairielearn/eslint-plugin",
-  "version": "2.2.7",
+  "version": "2.3.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/PrairieLearn/PrairieLearn.git",
@@ -13,15 +13,16 @@
     "test": "vitest run --coverage"
   },
   "dependencies": {
-    "@typescript-eslint/utils": "^8.46.2"
+    "@typescript-eslint/utils": "^8.49.0",
+    "typescript": "^5.9.3"
   },
   "devDependencies": {
     "@prairielearn/tsconfig": "^0.0.0",
-    "@types/node": "^22.18.13",
-    "@typescript-eslint/rule-tester": "^8.46.2",
-    "@vitest/coverage-v8": "^4.0.6",
-    "tsx": "^4.20.6",
-    "typescript": "^5.9.3",
-    "vitest": "^4.0.6"
+    "@types/node": "^22.19.1",
+    "@typescript-eslint/rule-tester": "^8.49.0",
+    "@typescript-eslint/types": "^8.49.0",
+    "@vitest/coverage-v8": "^4.0.14",
+    "tsx": "^4.21.0",
+    "vitest": "^4.0.14"
   }
 }

package/src/index.ts

@@ -2,10 +2,12 @@ import awsClientMandatoryConfig from './rules/aws-client-mandatory-config.js';
 import awsClientSharedConfig from './rules/aws-client-shared-config.js';
 import jsxNoDollarInterpolation from './rules/jsx-no-dollar-interpolation.js';
 import noUnusedSqlBlocks from './rules/no-unused-sql-blocks.js';
+import safeDbTypes from './rules/safe-db-types.js';
 
 export const rules = {
   'aws-client-mandatory-config': awsClientMandatoryConfig,
   'aws-client-shared-config': awsClientSharedConfig,
   'jsx-no-dollar-interpolation': jsxNoDollarInterpolation,
   'no-unused-sql-blocks': noUnusedSqlBlocks,
+  'safe-db-types': safeDbTypes,
 };

package/src/rules/safe-db-types.ts

@@ -0,0 +1,593 @@
+import { type TSESTree } from '@typescript-eslint/types';
+import { ESLintUtils } from '@typescript-eslint/utils';
+import * as ts from 'typescript';
+
+const HYDRATE_FUNCTION_NAME = 'hydrateHtml';
+const HYDRATE_COMPONENT_NAME = 'Hydrate';
+
+/**
+ * Check if a variable declaration is a Zod schema that uses schemas from db-types.ts
+ * For example: const RubricDataSchema = RubricSchema.extend({...})
+ */
+function checkZodSchemaForDbTypes(
+  declaration: ts.VariableDeclaration,
+  typeChecker: ts.TypeChecker,
+): string[] {
+  const violations: string[] = [];
+
+  if (!declaration.initializer) return violations;
+
+  // Walk the expression tree to find all identifiers
+  const findIdentifiers = (node: ts.Node): void => {
+    // Check property access expressions like RubricSchema.extend() or InstanceQuestionSchema.shape
+    if (ts.isPropertyAccessExpression(node)) {
+      const objectSymbol = typeChecker.getSymbolAtLocation(node.expression);
+      if (objectSymbol) {
+        const aliasedSymbol =
+          objectSymbol.flags & ts.SymbolFlags.Alias
+            ? typeChecker.getAliasedSymbol(objectSymbol)
+            : objectSymbol;
+        const decls = aliasedSymbol.getDeclarations();
+        if (decls && decls.length > 0) {
+          const sourceFile = decls[0].getSourceFile();
+          if (sourceFile.fileName.endsWith('/db-types.ts')) {
+            violations.push(aliasedSymbol.getName());
+          }
+        }
+      }
+    }
+
+    // Check spread elements in object literals (e.g., ...SomeSchema.shape)
+    if (ts.isSpreadAssignment(node)) {
+      // The expression being spread (e.g., SomeSchema.shape)
+      const spreadExpr = node.expression;
+
+      // Check if it's a property access (e.g., accessing .shape)
+      if (ts.isPropertyAccessExpression(spreadExpr)) {
+        const objectSymbol = typeChecker.getSymbolAtLocation(spreadExpr.expression);
+        if (objectSymbol) {
+          const aliasedSymbol =
+            objectSymbol.flags & ts.SymbolFlags.Alias
+              ? typeChecker.getAliasedSymbol(objectSymbol)
+              : objectSymbol;
+          const decls = aliasedSymbol.getDeclarations();
+          if (decls && decls.length > 0) {
+            const sourceFile = decls[0].getSourceFile();
+            if (sourceFile.fileName.endsWith('/db-types.ts')) {
+              violations.push(aliasedSymbol.getName());
+            } else {
+              // The schema is defined locally, check if IT uses db-types
+              for (const decl of decls) {
+                if (ts.isVariableDeclaration(decl)) {
+                  // Recursively check the local schema
+                  const nestedViolations = checkZodSchemaForDbTypes(decl, typeChecker);
+                  violations.push(...nestedViolations);
+                }
+              }
+            }
+          }
+        }
+      }
+      // Also check if the spread is a direct identifier (e.g., ...someObject)
+      else if (ts.isIdentifier(spreadExpr)) {
+        const spreadSymbol = typeChecker.getSymbolAtLocation(spreadExpr);
+        if (spreadSymbol) {
+          const aliasedSymbol =
+            spreadSymbol.flags & ts.SymbolFlags.Alias
+              ? typeChecker.getAliasedSymbol(spreadSymbol)
+              : spreadSymbol;
+          const decls = aliasedSymbol.getDeclarations();
+          if (decls && decls.length > 0) {
+            const sourceFile = decls[0].getSourceFile();
+            if (sourceFile.fileName.endsWith('/db-types.ts')) {
+              violations.push(aliasedSymbol.getName());
+            }
+          }
+        }
+      }
+    }
+
+    // Check call expressions for arguments
+    if (ts.isCallExpression(node)) {
+      for (const arg of node.arguments) {
+        // Check if argument is an identifier (e.g., RubricItemSchema)
+        if (ts.isIdentifier(arg)) {
+          const argSymbol = typeChecker.getSymbolAtLocation(arg);
+          if (argSymbol) {
+            const aliasedSymbol =
+              argSymbol.flags & ts.SymbolFlags.Alias
+                ? typeChecker.getAliasedSymbol(argSymbol)
+                : argSymbol;
+            const decls = aliasedSymbol.getDeclarations();
+            if (decls && decls.length > 0) {
+              const sourceFile = decls[0].getSourceFile();
+              if (sourceFile.fileName.endsWith('/db-types.ts')) {
+                violations.push(aliasedSymbol.getName());
+              }
+            }
+          }
+        }
+      }
+    }
+
+    // Check object literal property assignments (e.g., { rubric: RubricSchema })
+    if (ts.isPropertyAssignment(node) && ts.isIdentifier(node.initializer)) {
+      const identifier = node.initializer;
+      const symbol = typeChecker.getSymbolAtLocation(identifier);
+      if (symbol) {
+        const aliasedSymbol =
+          symbol.flags & ts.SymbolFlags.Alias ? typeChecker.getAliasedSymbol(symbol) : symbol;
+        const decls = aliasedSymbol.getDeclarations();
+        if (decls && decls.length > 0) {
+          const sourceFile = decls[0].getSourceFile();
+          if (sourceFile.fileName.endsWith('/db-types.ts')) {
+            violations.push(aliasedSymbol.getName());
+          }
+        }
+      }
+    }
+
+    ts.forEachChild(node, findIdentifiers);
+  };
+
+  findIdentifiers(declaration.initializer);
+  return violations;
+}
+
+/**
+ * Check if a type node is z.infer<typeof SchemaName> and if SchemaName uses db-types
+ * Returns the names of db-types that the schema depends on
+ */
+function checkForZodInferPattern(typeNode: ts.TypeNode, typeChecker: ts.TypeChecker): string[] {
+  // Check if this is a type reference with type arguments
+  if (!ts.isTypeReferenceNode(typeNode)) return [];
+
+  // Check if the type reference is named (e.g., "infer" from z.infer)
+  const typeName = typeNode.typeName;
+  if (!ts.isQualifiedName(typeName)) return [];
+
+  // Check if it's z.infer or similar pattern
+  // The pattern is: z.infer<typeof SchemaName>
+  const typeArgs = typeNode.typeArguments;
+  if (!typeArgs || typeArgs.length !== 1) return [];
+
+  const typeArg = typeArgs[0];
+
+  // Check if the type argument is a typeof expression
+  if (!ts.isTypeQueryNode(typeArg)) return [];
+
+  // Get the schema name from typeof X
+  const exprName = typeArg.exprName;
+  if (!ts.isIdentifier(exprName)) return [];
+
+  // Now find the schema variable declaration
+  const schemaSymbol = typeChecker.getSymbolAtLocation(exprName);
+  if (!schemaSymbol) return [];
+
+  // Check if this is an imported symbol (alias) - follow it to the original
+  const symbolToCheck =
+    schemaSymbol.flags & ts.SymbolFlags.Alias
+      ? typeChecker.getAliasedSymbol(schemaSymbol)
+      : schemaSymbol;
+
+  const schemaDecls = symbolToCheck.getDeclarations();
+  if (!schemaDecls || schemaDecls.length === 0) return [];
+
+  // Check if it's a variable declaration
+  for (const decl of schemaDecls) {
+    if (ts.isVariableDeclaration(decl)) {
+      // If the schema is defined in safe-db-types.ts, it's safe by definition
+      const sourceFile = decl.getSourceFile();
+      if (sourceFile.fileName.endsWith('/safe-db-types.ts')) {
+        return [];
+      }
+
+      // Use our existing helper to check if the schema uses db-types
+      return checkZodSchemaForDbTypes(decl, typeChecker);
+    }
+  }
+
+  return [];
+}
+
+function extractChild(children: TSESTree.JSXChild[]): TSESTree.JSXElement | null {
+  const nonWhitespaceChildren = children.filter((child) => {
+    if (child.type === 'JSXText') {
+      return child.value.trim().length > 0;
+    }
+    return true;
+  });
+
+  if (nonWhitespaceChildren.length !== 1 || nonWhitespaceChildren[0].type !== 'JSXElement') {
+    return null;
+  }
+
+  return nonWhitespaceChildren[0];
+}
+
+/**
+ * Check if a TypeScript type node references a type from db-types.ts
+ * This checks the actual source code type annotation, not the resolved type.
+ * Follows type aliases (imports) to their original declaration.
+ * Returns all unsafe type names found.
+ */
+function checkTypeNodeForDbTypes(
+  typeNode: ts.TypeNode,
+  typeChecker: ts.TypeChecker,
+  visited = new Set<ts.TypeNode>(),
+): string[] {
+  if (visited.has(typeNode)) return [];
+  visited.add(typeNode);
+
+  const violations: string[] = [];
+
+  // Check type references (e.g., User, Course, AuthnProvider)
+  if (ts.isTypeReferenceNode(typeNode)) {
+    const typeName = typeNode.typeName;
+    const symbol = typeChecker.getSymbolAtLocation(typeName);
+
+    if (symbol) {
+      // Check if this is an imported symbol (alias) - follow it to the original
+      const symbolToCheck =
+        symbol.flags & ts.SymbolFlags.Alias ? typeChecker.getAliasedSymbol(symbol) : symbol;
+
+      const declarations = symbolToCheck.getDeclarations();
+      if (declarations && declarations.length > 0) {
+        for (const decl of declarations) {
+          const sourceFile = decl.getSourceFile();
+          if (sourceFile.fileName.endsWith('/db-types.ts')) {
+            // Found a type from db-types.ts!
+            violations.push(symbolToCheck.getName());
+          } else {
+            // If it's a type alias or interface defined locally, check its properties
+            if (ts.isTypeAliasDeclaration(decl) && decl.type) {
+              // Special case: Check if this is z.infer<typeof XxxSchema>
+              const zodSchemaViolations = checkForZodInferPattern(decl.type, typeChecker);
+              violations.push(...zodSchemaViolations);
+
+              // Also check the type itself
+              const nestedViolations = checkTypeNodeForDbTypes(decl.type, typeChecker, visited);
+              violations.push(...nestedViolations);
+            } else if (ts.isInterfaceDeclaration(decl)) {
+              // Check interface members
+              for (const member of decl.members) {
+                if (ts.isPropertySignature(member) && member.type) {
+                  const nestedViolations = checkTypeNodeForDbTypes(
+                    member.type,
+                    typeChecker,
+                    visited,
+                  );
+                  violations.push(...nestedViolations);
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+
+    // Check type arguments (e.g., Array<User>, Promise<Course>)
+    if (typeNode.typeArguments) {
+      for (const typeArg of typeNode.typeArguments) {
+        const nestedViolations = checkTypeNodeForDbTypes(typeArg, typeChecker, visited);
+        violations.push(...nestedViolations);
+      }
+    }
+  }
+
+  // Check array types (e.g., User[])
+  if (ts.isArrayTypeNode(typeNode)) {
+    const nestedViolations = checkTypeNodeForDbTypes(typeNode.elementType, typeChecker, visited);
+    violations.push(...nestedViolations);
+  }
+
+  // Check union types (e.g., User | null)
+  if (ts.isUnionTypeNode(typeNode)) {
+    for (const type of typeNode.types) {
+      const nestedViolations = checkTypeNodeForDbTypes(type, typeChecker, visited);
+      violations.push(...nestedViolations);
+    }
+  }
+
+  // Check intersection types (e.g., User & { extra: string })
+  if (ts.isIntersectionTypeNode(typeNode)) {
+    for (const type of typeNode.types) {
+      const nestedViolations = checkTypeNodeForDbTypes(type, typeChecker, visited);
+      violations.push(...nestedViolations);
+    }
+  }
+
+  // Check object type literals and their properties
+  if (ts.isTypeLiteralNode(typeNode)) {
+    for (const member of typeNode.members) {
+      if (ts.isPropertySignature(member) && member.type) {
+        const nestedViolations = checkTypeNodeForDbTypes(member.type, typeChecker, visited);
+        violations.push(...nestedViolations);
+      }
+    }
+  }
+
+  // Check indexed access types (e.g., User['name'])
+  // These are safe! We're only extracting a specific property, not passing the whole object.
+  // So we DON'T recurse into the object type for indexed access.
+  if (ts.isIndexedAccessTypeNode(typeNode)) {
+    // Do not check - indexed access is safe
+  }
+
+  return violations;
+}
+
+/**
+ * Check if a type name is in the allowlist of safe types
+ */
+function isTypeInAllowlist(typeName: string, allowlist: (string | RegExp)[]): boolean {
+  return allowlist.some((pattern) => {
+    if (typeof pattern === 'string') {
+      return typeName === pattern;
+    }
+    return pattern.test(typeName);
+  });
+}
+
+/**
+ * Check the props of a component for unsafe types from db-types.ts
+ */
+function checkComponentProps(
+  context: ReturnType<typeof ESLintUtils.RuleCreator.withoutDocs>['create'] extends (
+    context: infer C,
+  ) => any
+    ? C
+    : never,
+  typeChecker: ts.TypeChecker,
+  componentSymbol: ts.Symbol,
+  tsComponentNode: ts.Node,
+  jsxElement: TSESTree.JSXElement,
+  reportNode: TSESTree.Node,
+  allowlist: (string | RegExp)[],
+): void {
+  const childOpeningElement = jsxElement.openingElement;
+
+  // Get the component's type (function or class component)
+  const componentType = typeChecker.getTypeOfSymbolAtLocation(componentSymbol, tsComponentNode);
+  const signatures = componentType.getCallSignatures();
+
+  if (signatures.length === 0) return;
+
+  // Get the first parameter (props) of the component function
+  const propsParam = signatures[0].getParameters()[0];
+  if (!propsParam) return;
+
+  const propsDeclaration = propsParam.valueDeclaration;
+
+  if (!propsDeclaration || !ts.isParameter(propsDeclaration)) return;
+
+  // Get the type annotation node from the props parameter
+  const propsTypeNode = propsDeclaration.type;
+  if (!propsTypeNode) return;
+
+  // Check each property in the props type
+  if (ts.isTypeLiteralNode(propsTypeNode)) {
+    // Inline props object: { foo: string; bar: number }
+    for (const member of propsTypeNode.members) {
+      if (ts.isPropertySignature(member) && member.type && member.name) {
+        if (!ts.isIdentifier(member.name)) continue;
+
+        const propName = member.name.text;
+        const violations = checkTypeNodeForDbTypes(member.type, typeChecker);
+
+        if (violations.length > 0) {
+          // Find the JSX attribute for this prop
+          const attribute = childOpeningElement.attributes.find(
+            (attr) =>
+              attr.type === 'JSXAttribute' &&
+              attr.name.type === 'JSXIdentifier' &&
+              attr.name.name === propName,
+          );
+
+          for (const typeName of violations) {
+            if (isTypeInAllowlist(typeName, allowlist)) continue;
+
+            context.report({
+              node: attribute || reportNode,
+              messageId: 'unsafeTypes',
+              data: { propName, typeName },
+            });
+          }
+        }
+      }
+    }
+  } else if (ts.isTypeReferenceNode(propsTypeNode)) {
+    // Props is a type reference (e.g., interface or type alias)
+    const symbol = typeChecker.getSymbolAtLocation(propsTypeNode.typeName);
+    if (symbol) {
+      const resolvedSymbol =
+        symbol.flags & ts.SymbolFlags.Alias ? typeChecker.getAliasedSymbol(symbol) : symbol;
+      const declarations = resolvedSymbol.getDeclarations();
+
+      if (declarations && declarations.length > 0) {
+        for (const decl of declarations) {
+          if (ts.isInterfaceDeclaration(decl) || ts.isTypeLiteralNode(decl)) {
+            const members = ts.isInterfaceDeclaration(decl) ? decl.members : decl.members;
+
+            for (const member of members) {
+              if (ts.isPropertySignature(member) && member.type && member.name) {
+                if (!ts.isIdentifier(member.name)) continue;
+
+                const propName = member.name.text;
+                const violations = checkTypeNodeForDbTypes(member.type, typeChecker);
+
+                if (violations.length > 0) {
+                  // Find the JSX attribute for this prop
+                  const attribute = childOpeningElement.attributes.find(
+                    (attr) =>
+                      attr.type === 'JSXAttribute' &&
+                      attr.name.type === 'JSXIdentifier' &&
+                      attr.name.name === propName,
+                  );
+
+                  for (const typeName of violations) {
+                    if (isTypeInAllowlist(typeName, allowlist)) continue;
+
+                    context.report({
+                      node: attribute || reportNode,
+                      messageId: 'unsafeTypes',
+                      data: { propName, typeName },
+                    });
+                  }
+                }
+              }
+            }
+          } else if (ts.isTypeAliasDeclaration(decl) && decl.type) {
+            // Type alias might be an inline object type
+            if (ts.isTypeLiteralNode(decl.type)) {
+              for (const member of decl.type.members) {
+                if (ts.isPropertySignature(member) && member.type && member.name) {
+                  if (!ts.isIdentifier(member.name)) continue;
+
+                  const propName = member.name.text;
+                  const violations = checkTypeNodeForDbTypes(member.type, typeChecker);
+
+                  if (violations.length > 0) {
+                    // Find the JSX attribute for this prop
+                    const attribute = childOpeningElement.attributes.find(
+                      (attr) =>
+                        attr.type === 'JSXAttribute' &&
+                        attr.name.type === 'JSXIdentifier' &&
+                        attr.name.name === propName,
+                    );
+
+                    for (const typeName of violations) {
+                      if (isTypeInAllowlist(typeName, allowlist)) continue;
+
+                      context.report({
+                        node: attribute || reportNode,
+                        messageId: 'unsafeTypes',
+                        data: { propName, typeName },
+                      });
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  // Check for spread attributes
+  const attributes = childOpeningElement.attributes;
+  for (const attr of attributes) {
+    if (attr.type === 'JSXSpreadAttribute') {
+      context.report({
+        node: reportNode,
+        messageId: 'spreadAttributes',
+      });
+      continue;
+    }
+  }
+}
+
+export default ESLintUtils.RuleCreator.withoutDocs<
+  [{ allowDbTypes?: (string | RegExp)[] }?],
+  'spreadAttributes' | 'unsafeTypes'
+>({
+  meta: {
+    type: 'problem',
+    messages: {
+      spreadAttributes: 'Spread attributes are not allowed in Hydrate children.',
+      unsafeTypes:
+        'Prop "{{propName}}" uses type "{{typeName}}" which is derived from db-types.ts. Use safe-db-types.ts instead.',
+    },
+    schema: [
+      {
+        type: 'object',
+        properties: {
+          allowDbTypes: {
+            type: 'array',
+            items: {
+              type: 'string',
+            },
+          },
+        },
+        additionalProperties: false,
+      },
+    ],
+  },
+  defaultOptions: [{}],
+  create(context) {
+    const options = context.options[0] || {};
+    const allowlist = options.allowDbTypes || [];
+    return {
+      JSXElement(node) {
+        const openingElementNameExpression = node.openingElement.name;
+        if (openingElementNameExpression.type !== 'JSXIdentifier') return;
+
+        const elementName = openingElementNameExpression.name;
+        if (elementName !== HYDRATE_COMPONENT_NAME) return;
+
+        const child = extractChild(node.children);
+        if (!child) return;
+
+        // Get the component being rendered
+        const childOpeningElement = child.openingElement;
+        const childElementName = childOpeningElement.name;
+
+        if (childElementName.type !== 'JSXIdentifier') return;
+
+        // Get the component's type to inspect its props
+        const services = ESLintUtils.getParserServices(context);
+        const typeChecker = services.program.getTypeChecker();
+        const tsChildNode = services.esTreeNodeToTSNodeMap.get(childElementName);
+        const componentSymbol = typeChecker.getSymbolAtLocation(tsChildNode);
+
+        if (!componentSymbol) return;
+
+        checkComponentProps(
+          context,
+          typeChecker,
+          componentSymbol,
+          tsChildNode,
+          child,
+          child,
+          allowlist,
+        );
+      },
+
+      CallExpression(node) {
+        // Check for hydrateHtml(<Component ... />, props?) calls
+        if (node.callee.type !== 'Identifier' || node.callee.name !== HYDRATE_FUNCTION_NAME) return;
+
+        // Should have at least one argument, the first is JSX element.
+        if (node.arguments.length === 0) return;
+
+        const arg = node.arguments[0];
+        if (arg.type !== 'JSXElement') return;
+
+        const jsxElement = arg;
+        const openingElement = jsxElement.openingElement;
+        const elementName = openingElement.name;
+
+        if (elementName.type !== 'JSXIdentifier') return;
+
+        // Get the component's type to inspect its props
+        const services = ESLintUtils.getParserServices(context);
+        const typeChecker = services.program.getTypeChecker();
+        const tsElementNode = services.esTreeNodeToTSNodeMap.get(elementName);
+        const componentSymbol = typeChecker.getSymbolAtLocation(tsElementNode);
+
+        if (!componentSymbol) return;
+
+        checkComponentProps(
+          context,
+          typeChecker,
+          componentSymbol,
+          tsElementNode,
+          jsxElement,
+          node,
+          allowlist,
+        );
+      },
+    };
+  },
+});