@prairielearn/eslint-plugin 4.0.0 → 4.2.0

package/src/rules/require-trpc-permission-middleware.ts

@@ -0,0 +1,168 @@
+import { ASTUtils, ESLintUtils, type TSESLint, type TSESTree } from '@typescript-eslint/utils';
+
+const { findVariable } = ASTUtils;
+
+/**
+ * tRPC procedures must enforce their own authorization via a `require*`
+ * permission middleware in the chain.
+ * Individual procedures often need stricter permissions than the page they're
+ * mounted under (e.g. an Edit-only mutation under a route that allows View).
+ * Requiring an explicit permission middleware per procedure makes the
+ * authz gate visible at the call site and helps prevent missing permission checks.
+ *
+ * Bad:
+ * ```ts
+ * const list = t.procedure.query(async ({ ctx }) => { ... });
+ * ```
+ *
+ * Good:
+ * ```ts
+ * const list = t.procedure.use(requireCoursePermissionEdit).query(...);
+ * ```
+ *
+ * Recognized permission middlewares:
+ * - requireCoursePermissionPreview / View / Edit / Own
+ * - requireCourseInstancePermissionPreview / View / Edit / Own
+ * - requireAdministrator
+ *
+ * Feature gates like `requireEnhancedAccessControl` and `requireAiGradingFeature`
+ * don't count — they must be paired with a permission middleware.
+ *
+ * The rule follows intermediate procedure-base variables so patterns like
+ * `const protected = t.procedure.use(...); ...; protected.query(...)` are
+ * checked end-to-end.
+ */
+
+// TODO: This list requires manual maintenance. We should consider making feature gates
+// not use the `require` prefix, and then we can use a more generic pattern here.
+const PERMISSION_MIDDLEWARE_PATTERN =
+  /^require(Course|CourseInstance)Permission(Preview|View|Edit|Own)$|^requireAdministrator$/;
+const TERMINAL_METHODS = new Set(['query', 'mutation', 'subscription']);
+
+function unwrapMemberObject(expr: TSESTree.Expression): TSESTree.Expression {
+  return expr.type === 'TSNonNullExpression' || expr.type === 'TSAsExpression'
+    ? unwrapMemberObject(expr.expression)
+    : expr;
+}
+
+function isTProcedure(expr: TSESTree.Expression): boolean {
+  return (
+    expr.type === 'MemberExpression' &&
+    !expr.computed &&
+    expr.property.type === 'Identifier' &&
+    expr.property.name === 'procedure' &&
+    expr.object.type === 'Identifier' &&
+    expr.object.name === 't'
+  );
+}
+
+interface ChainInfo {
+  matchesTProcedure: boolean;
+  middlewares: string[];
+}
+
+/**
+ * Walks back through a chain like `expr.use(A).input(B).use(C)` collecting
+ * `.use(...)` argument identifiers. If the base of the chain is `t.procedure`,
+ * returns the collected middlewares. If the base is a variable, follows the
+ * variable's initializer (e.g. `const protected = t.procedure.use(X)`).
+ */
+function getProcedureChainInfo(
+  expr: TSESTree.Expression,
+  scope: TSESLint.Scope.Scope,
+  visited: Set<TSESTree.Node>,
+): ChainInfo {
+  if (visited.has(expr)) return { matchesTProcedure: false, middlewares: [] };
+  visited.add(expr);
+
+  const middlewares: string[] = [];
+  let cursor: TSESTree.Expression = expr;
+
+  while (cursor.type === 'CallExpression') {
+    const callee = cursor.callee;
+    if (
+      callee.type !== 'MemberExpression' ||
+      callee.computed ||
+      callee.property.type !== 'Identifier'
+    ) {
+      return { matchesTProcedure: false, middlewares: [] };
+    }
+    if (callee.property.name === 'use' && cursor.arguments[0]?.type === 'Identifier') {
+      middlewares.push(cursor.arguments[0].name);
+    }
+    cursor = callee.object;
+  }
+
+  cursor = unwrapMemberObject(cursor);
+
+  if (isTProcedure(cursor)) {
+    return { matchesTProcedure: true, middlewares };
+  }
+
+  // Follow an intermediate procedure-base variable defined in the same module:
+  //   const protectedProcedure = t.procedure.use(...);
+  //   protectedProcedure.query(...);
+  if (cursor.type === 'Identifier') {
+    const variable = findVariable(scope, cursor);
+    if (variable && variable.defs.length === 1) {
+      const def = variable.defs[0];
+      if (
+        def.node.type === 'VariableDeclarator' &&
+        def.node.init &&
+        // Conservative: only follow `const` bindings to avoid stale data
+        // from let/var rebinding.
+        def.parent?.type === 'VariableDeclaration' &&
+        def.parent.kind === 'const'
+      ) {
+        const upstream = getProcedureChainInfo(def.node.init, scope, visited);
+        if (upstream.matchesTProcedure) {
+          return {
+            matchesTProcedure: true,
+            middlewares: [...middlewares, ...upstream.middlewares],
+          };
+        }
+      }
+    }
+  }
+
+  return { matchesTProcedure: false, middlewares: [] };
+}
+
+export default ESLintUtils.RuleCreator.withoutDocs({
+  meta: {
+    type: 'problem',
+    messages: {
+      missingPermissionMiddleware:
+        'tRPC procedure must call .use() with a permission middleware (e.g. requireCoursePermissionEdit)',
+    },
+    schema: [],
+  },
+  defaultOptions: [],
+
+  create(context) {
+    return {
+      CallExpression(node) {
+        if (
+          node.callee.type !== 'MemberExpression' ||
+          node.callee.computed ||
+          node.callee.property.type !== 'Identifier' ||
+          !TERMINAL_METHODS.has(node.callee.property.name)
+        ) {
+          return;
+        }
+
+        const scope = context.sourceCode.getScope(node);
+        const info = getProcedureChainInfo(node.callee.object, scope, new Set());
+
+        if (!info.matchesTProcedure) return;
+
+        const hasPermissionGate = info.middlewares.some((name) =>
+          PERMISSION_MIDDLEWARE_PATTERN.test(name),
+        );
+        if (!hasPermissionGate) {
+          context.report({ node, messageId: 'missingPermissionMiddleware' });
+        }
+      },
+    };
+  },
+});

package/src/tests/aws-client-mandatory-config.test.ts

@@ -1,7 +1,7 @@
 import { RuleTester } from '@typescript-eslint/rule-tester';
 import { afterAll, describe, it } from 'vitest';
 
-import rule from '../rules/aws-client-mandatory-config';
+import rule from '../rules/aws-client-mandatory-config.js';
 
 RuleTester.afterAll = afterAll;
 RuleTester.describe = describe;

package/src/tests/aws-client-shared-config.test.ts

@@ -1,7 +1,7 @@
 import { RuleTester } from '@typescript-eslint/rule-tester';
 import { afterAll, describe, it } from 'vitest';
 
-import rule from '../rules/aws-client-shared-config';
+import rule from '../rules/aws-client-shared-config.js';
 
 RuleTester.afterAll = afterAll;
 RuleTester.describe = describe;

package/src/tests/jsx-no-dollar-interpolation.test.ts

@@ -1,7 +1,7 @@
 import { RuleTester } from '@typescript-eslint/rule-tester';
 import { afterAll, describe, it } from 'vitest';
 
-import rule from '../rules/jsx-no-dollar-interpolation';
+import rule from '../rules/jsx-no-dollar-interpolation.js';
 
 RuleTester.afterAll = afterAll;
 RuleTester.describe = describe;

package/src/tests/no-current-target-in-callback.test.ts

@@ -38,10 +38,40 @@ ruleTester.run('no-current-target-in-callback', rule, {
     {
       code: '<Component render={(e) => setFoo(() => e.currentTarget)} />',
     },
+    // Synchronous nested callbacks are safe
+    {
+      code: '<input onChange={(e) => items.map(() => e.currentTarget.value)} />',
+    },
+    {
+      code: `const handlePaste = (e: React.ClipboardEvent<HTMLInputElement>) => {
+        fields.find((field) => field.name === e.currentTarget.name);
+      };`,
+    },
+    {
+      code: `const handlePaste = (e: React.ClipboardEvent<HTMLInputElement>) => {
+        const cursorPosition = run(() => e.currentTarget.selectionStart ?? 0);
+        return cursorPosition;
+      };`,
+    },
     // Direct setState without callback
     {
       code: '<input onChange={(e) => setChecks({ value: e.currentTarget.checked })} />',
     },
+    // Capturing currentTarget before await is safe
+    {
+      code: `const handleSubmit = async (e: React.SubmitEvent<HTMLFormElement>) => {
+        const form = e.currentTarget;
+        await trigger();
+        form.submit();
+      };`,
+    },
+    // Destructuring currentTarget before await is safe
+    {
+      code: `const handleSubmit = async ({ currentTarget }: React.SubmitEvent<HTMLFormElement>) => {
+        await trigger();
+        currentTarget.submit();
+      };`,
+    },
     // Event target (not currentTarget) - different issue, not covered by this rule
     {
       code: '<input onChange={(e) => setChecks((c) => ({ ...c, value: e.target.checked }))} />',
@@ -79,21 +109,11 @@ ruleTester.run('no-current-target-in-callback', rule, {
       code: '<button onClick={(e) => setFoo((prev) => ({ ...prev, clicked: e.currentTarget.id }))} />',
       errors: [{ messageId: 'noCurrentTargetInCallback' }],
     },
-    // Nested arrow function in array method
-    {
-      code: '<input onChange={(e) => items.map(() => e.currentTarget.value)} />',
-      errors: [{ messageId: 'noCurrentTargetInCallback' }],
-    },
     // Function expression callback
     {
       code: '<input onChange={(e) => setChecks(function(c) { return { ...c, value: e.currentTarget.checked }; })} />',
       errors: [{ messageId: 'noCurrentTargetInCallback' }],
     },
-    // Deeply nested
-    {
-      code: '<input onChange={(e) => outer(() => inner(() => e.currentTarget.value))} />',
-      errors: [{ messageId: 'noCurrentTargetInCallback' }],
-    },
     // With block body
     {
       code: `<input onChange={(e) => {
@@ -103,5 +123,42 @@ ruleTester.run('no-current-target-in-callback', rule, {
       }} />`,
       errors: [{ messageId: 'noCurrentTargetInCallback' }],
     },
+    // Promise callbacks are deferred
+    {
+      code: `<input onChange={(e) => {
+        Promise.resolve().then(() => e.currentTarget.value);
+      }} />`,
+      errors: [{ messageId: 'noCurrentTargetInCallback' }],
+    },
+    // Timer callbacks are deferred
+    {
+      code: `<input onChange={(e) => {
+        setTimeout(() => e.currentTarget.value, 0);
+      }} />`,
+      errors: [{ messageId: 'noCurrentTargetInCallback' }],
+    },
+    // Access after await in a typed event handler
+    {
+      code: `const handleSubmit = async (e: React.SubmitEvent<HTMLFormElement>) => {
+        await trigger();
+        e.currentTarget.submit();
+      };`,
+      errors: [{ messageId: 'noCurrentTargetInCallback' }],
+    },
+    // Access after await in an inline JSX handler
+    {
+      code: `<form onSubmit={async (e) => {
+        await trigger();
+        e.currentTarget.submit();
+      }} />`,
+      errors: [{ messageId: 'noCurrentTargetInCallback' }],
+    },
+    // react-hook-form handleSubmit callbacks are also after the original event boundary
+    {
+      code: `const onSubmit = handleSubmit((_data, e) => {
+        e.currentTarget.submit();
+      });`,
+      errors: [{ messageId: 'noCurrentTargetInCallback' }],
+    },
   ],
 });

package/src/tests/no-hydrate-reslocals.test.ts

@@ -0,0 +1,89 @@
+import { RuleTester } from '@typescript-eslint/rule-tester';
+import { afterAll, describe, it } from 'vitest';
+
+import rule from '../rules/no-hydrate-reslocals.js';
+
+RuleTester.afterAll = afterAll;
+RuleTester.describe = describe;
+RuleTester.it = it;
+
+const ruleTester = new RuleTester({
+  languageOptions: {
+    parserOptions: {
+      ecmaFeatures: {
+        jsx: true,
+      },
+    },
+  },
+});
+
+ruleTester.run('no-hydrate-reslocals', rule, {
+  valid: [
+    {
+      code: '<Hydrate><Child foo={1} bar="baz" /></Hydrate>',
+    },
+    {
+      code: '<Hydrate><Child course={course} assessment={assessment} /></Hydrate>',
+    },
+    {
+      code: '<SomeOther resLocals={res.locals}><Child /></SomeOther>',
+    },
+    {
+      code: '<Hydrate><Child {...otherProps} /></Hydrate>',
+    },
+    {
+      code: '<Hydrate resLocals={foo}><Child /></Hydrate>',
+    },
+    {
+      code: 'hydrateHtml(<Child foo={1} bar="baz" />)',
+    },
+    {
+      code: 'hydrateHtml(<Child {...otherProps} />)',
+    },
+    {
+      code: 'otherFunction(<Child resLocals={res.locals} />)',
+    },
+  ],
+  invalid: [
+    {
+      code: '<Hydrate><Child resLocals={res.locals} /></Hydrate>',
+      errors: [{ messageId: 'forbiddenProp', data: { name: 'resLocals' } }],
+    },
+    {
+      code: '<Hydrate><Child locals={res.locals} /></Hydrate>',
+      errors: [{ messageId: 'forbiddenProp', data: { name: 'locals' } }],
+    },
+    {
+      code: '<Hydrate><Child {...res.locals} /></Hydrate>',
+      errors: [{ messageId: 'forbiddenSpread' }],
+    },
+    {
+      code: '<Hydrate><Child {...resLocals} /></Hydrate>',
+      errors: [{ messageId: 'forbiddenSpread' }],
+    },
+    {
+      code: '<Hydrate><Child {...locals} /></Hydrate>',
+      errors: [{ messageId: 'forbiddenSpread' }],
+    },
+    {
+      code: '<Hydrate fullHeight><Child foo={1} resLocals={res.locals} /></Hydrate>',
+      errors: [{ messageId: 'forbiddenProp', data: { name: 'resLocals' } }],
+    },
+    {
+      code: 'hydrateHtml(<Child resLocals={res.locals} />)',
+      errors: [{ messageId: 'forbiddenProp', data: { name: 'resLocals' } }],
+    },
+    {
+      code: 'hydrateHtml(<Child locals={res.locals} />)',
+      errors: [{ messageId: 'forbiddenProp', data: { name: 'locals' } }],
+    },
+    {
+      code: 'hydrateHtml(<Child {...res.locals} />)',
+      errors: [{ messageId: 'forbiddenSpread' }],
+    },
+    {
+      code: 'hydrateHtml(<Child {...resLocals} />, { fullHeight: true })',
+      errors: [{ messageId: 'forbiddenSpread' }],
+    },
+  ],
+});

package/src/tests/require-trpc-permission-middleware.test.ts

@@ -0,0 +1,109 @@
+import { RuleTester } from '@typescript-eslint/rule-tester';
+import { afterAll, describe, it } from 'vitest';
+
+import rule from '../rules/require-trpc-permission-middleware.js';
+
+RuleTester.afterAll = afterAll;
+RuleTester.describe = describe;
+RuleTester.it = it;
+
+const ruleTester = new RuleTester();
+
+ruleTester.run('require-trpc-permission-middleware', rule, {
+  valid: [
+    {
+      code: 'const list = t.procedure.use(requireCoursePermissionEdit).query(async () => {});',
+    },
+    {
+      code: 'const m = t.procedure.use(requireCoursePermissionPreview).mutation(async () => {});',
+    },
+    {
+      code: `const m = t.procedure
+        .use(requireEnhancedAccessControl)
+        .use(requireCourseInstancePermissionView)
+        .query(async () => {});`,
+    },
+    {
+      code: 'const m = t.procedure.use(requireAdministrator).mutation(async () => {});',
+    },
+    {
+      code: `const m = t.procedure
+        .use(requireCourseInstancePermissionEdit)
+        .input(z.object({}))
+        .mutation(async () => {});`,
+    },
+    {
+      code: 'const list = t.procedure.use(requireCoursePermissionOwn).query(async () => {});',
+    },
+    // Not a t.procedure chain — should be ignored
+    {
+      code: 'const fn = somethingElse.query(async () => {});',
+    },
+    {
+      code: 'const fn = otherRouter.procedure.query(async () => {});',
+    },
+    // Intermediate procedure-base variable: permission middleware on the base
+    {
+      code: `
+        const protectedProcedure = t.procedure.use(requireCoursePermissionOwn);
+        const m = protectedProcedure.query(async () => {});
+      `,
+    },
+    // Intermediate procedure-base variable: permission added downstream
+    {
+      code: `
+        const featureProcedure = t.procedure.use(requireAiGradingFeature);
+        const m = featureProcedure.use(requireAdministrator).mutation(async () => {});
+      `,
+    },
+    // Imported procedure base — we can't follow across files, so don't fire
+    {
+      code: `
+        import { protectedProcedure } from './foo.js';
+        const m = protectedProcedure.query(async () => {});
+      `,
+      languageOptions: { parserOptions: { sourceType: 'module' } },
+    },
+  ],
+  invalid: [
+    {
+      code: 'const list = t.procedure.query(async () => {});',
+      errors: [{ messageId: 'missingPermissionMiddleware' }],
+    },
+    {
+      code: 'const m = t.procedure.input(z.object({})).mutation(async () => {});',
+      errors: [{ messageId: 'missingPermissionMiddleware' }],
+    },
+    // Feature gate alone is not a permission gate
+    {
+      code: 'const m = t.procedure.use(requireEnhancedAccessControl).mutation(async () => {});',
+      errors: [{ messageId: 'missingPermissionMiddleware' }],
+    },
+    {
+      code: 'const m = t.procedure.use(requireAiGradingFeature).mutation(async () => {});',
+      errors: [{ messageId: 'missingPermissionMiddleware' }],
+    },
+    {
+      code: `const m = t.procedure
+        .input(z.object({}))
+        .output(z.object({}))
+        .subscription(async () => {});`,
+      errors: [{ messageId: 'missingPermissionMiddleware' }],
+    },
+    // Intermediate procedure-base variable with only a feature gate is still a miss
+    {
+      code: `
+        const featureProcedure = t.procedure.use(requireAiGradingFeature);
+        const m = featureProcedure.query(async () => {});
+      `,
+      errors: [{ messageId: 'missingPermissionMiddleware' }],
+    },
+    {
+      code: `
+        const featureProcedure = t.procedure.use(requireAiGradingFeature);
+        const m = featureProcedure.input(z.object({})).mutation(async () => {});
+      `,
+      errors: [{ messageId: 'missingPermissionMiddleware' }],
+    },
+  ],
+});

package/tsconfig.json

@@ -1,9 +1,3 @@
 {
-  // This must be a CJS package because ESLint doesn't support ESM plugins.
-  "extends": "@prairielearn/tsconfig/tsconfig.package-cjs.json",
-  "compilerOptions": {
-    "outDir": "./dist",
-    "rootDir": "./src",
-    "types": ["node"]
-  }
+  "extends": "@prairielearn/tsconfig/tsconfig.package-node.json"
 }