@prairielearn/eslint-plugin 4.1.0 → 4.2.0

package/dist/rules/no-unused-sql-blocks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"no-unused-sql-blocks.d.ts","sourceRoot":"","sources":["../../src/rules/no-unused-sql-blocks.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;;AAsBvD,wBAuCG","sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\n\nimport { ESLintUtils } from '@typescript-eslint/utils';\n\nfunction extractSqlBlockDefinitions(sqlContent: string): Set<string> {\n  const regex = / *-- *BLOCK +([^ \\n]+) */g;\n  const defs = new Set<string>();\n  let match;\n  while ((match = regex.exec(sqlContent)) !== null) {\n    defs.add(match[1]);\n  }\n  return defs;\n}\n\nfunction extractSqlBlockReferences(tsContent: string): Set<string> {\n  const regex = /sql\\.([a-zA-Z0-9_]+)/g;\n  const refs = new Set<string>();\n  let match;\n  while ((match = regex.exec(tsContent)) !== null) {\n    refs.add(match[1]);\n  }\n  return refs;\n}\n\nexport default ESLintUtils.RuleCreator.withoutDocs({\n  meta: {\n    type: 'problem',\n    messages: {\n      unusedSqlBlock:\n        'SQL block \"{{block}}\" in \"{{sqlFile}}\" is not used in this file and should be deleted.',\n    },\n    schema: [],\n  },\n  defaultOptions: [],\n  create(context) {\n    const components = path.parse(context.filename);\n    components.ext = '.sql';\n    const sqlFile = path.join(components.dir, components.name) + components.ext;\n    if (!fs.existsSync(sqlFile)) return {};\n    const tsContent = fs.readFileSync(context.filename, 'utf8');\n    const sqlContent = fs.readFileSync(sqlFile, 'utf8');\n\n    const usedBlocks = extractSqlBlockReferences(tsContent);\n    const definedBlocks = extractSqlBlockDefinitions(sqlContent);\n\n    const unusedBlocks = [...definedBlocks].filter((block) => !usedBlocks.has(block));\n\n    return {\n      Program(node) {\n        for (const block of unusedBlocks) {\n          context.report({\n            node,\n            loc: {\n              start: { line: 1, column: 1 },\n              end: { line: 2, column: 0 },\n            },\n            messageId: 'unusedSqlBlock',\n            data: { block, sqlFile: path.basename(sqlFile) },\n          });\n        }\n      },\n    };\n  },\n});\n"]}
+{"version":3,"file":"no-unused-sql-blocks.d.ts","sourceRoot":"","sources":["../../src/rules/no-unused-sql-blocks.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC","sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\n\nimport { ESLintUtils } from '@typescript-eslint/utils';\n\nfunction extractSqlBlockDefinitions(sqlContent: string): Set<string> {\n  const regex = / *-- *BLOCK +([^ \\n]+) */g;\n  const defs = new Set<string>();\n  let match;\n  while ((match = regex.exec(sqlContent)) !== null) {\n    defs.add(match[1]);\n  }\n  return defs;\n}\n\nfunction extractSqlBlockReferences(tsContent: string): Set<string> {\n  const regex = /sql\\.([a-zA-Z0-9_]+)/g;\n  const refs = new Set<string>();\n  let match;\n  while ((match = regex.exec(tsContent)) !== null) {\n    refs.add(match[1]);\n  }\n  return refs;\n}\n\nexport default ESLintUtils.RuleCreator.withoutDocs({\n  meta: {\n    type: 'problem',\n    messages: {\n      unusedSqlBlock:\n        'SQL block \"{{block}}\" in \"{{sqlFile}}\" is not used in this file and should be deleted.',\n    },\n    schema: [],\n  },\n  defaultOptions: [],\n  create(context) {\n    const components = path.parse(context.filename);\n    components.ext = '.sql';\n    const sqlFile = path.join(components.dir, components.name) + components.ext;\n    if (!fs.existsSync(sqlFile)) return {};\n    const tsContent = fs.readFileSync(context.filename, 'utf8');\n    const sqlContent = fs.readFileSync(sqlFile, 'utf8');\n\n    const usedBlocks = extractSqlBlockReferences(tsContent);\n    const definedBlocks = extractSqlBlockDefinitions(sqlContent);\n\n    const unusedBlocks = [...definedBlocks].filter((block) => !usedBlocks.has(block));\n\n    return {\n      Program(node) {\n        for (const block of unusedBlocks) {\n          context.report({\n            node,\n            loc: {\n              start: { line: 1, column: 1 },\n              end: { line: 2, column: 0 },\n            },\n            messageId: 'unusedSqlBlock',\n            data: { block, sqlFile: path.basename(sqlFile) },\n          });\n        }\n      },\n    };\n  },\n});\n"]}

package/dist/rules/no-unused-sql-blocks.js

@@ -1,41 +1,6 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
-const utils_1 = require("@typescript-eslint/utils");
+import * as fs from 'fs';
+import * as path from 'path';
+import { ESLintUtils } from '@typescript-eslint/utils';
 function extractSqlBlockDefinitions(sqlContent) {
     const regex = / *-- *BLOCK +([^ \n]+) */g;
     const defs = new Set();
@@ -54,7 +19,7 @@ function extractSqlBlockReferences(tsContent) {
     }
     return refs;
 }
-exports.default = utils_1.ESLintUtils.RuleCreator.withoutDocs({
+export default ESLintUtils.RuleCreator.withoutDocs({
     meta: {
         type: 'problem',
         messages: {

package/dist/rules/no-unused-sql-blocks.js.map

@@ -1 +1 @@
-{"version":3,"file":"no-unused-sql-blocks.js","sourceRoot":"","sources":["../../src/rules/no-unused-sql-blocks.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,MAAY,EAAE,+BAAW;AACzB,MAAY,IAAI,iCAAa;AAE7B,oDAAuD;AAEvD,SAAS,0BAA0B,CAAC,UAAkB;IACpD,MAAM,KAAK,GAAG,2BAA2B,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,KAAK,CAAC;IACV,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,yBAAyB,CAAC,SAAiB;IAClD,MAAM,KAAK,GAAG,uBAAuB,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,KAAK,CAAC;IACV,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;kBAEc,mBAAW,CAAC,WAAW,CAAC,WAAW,CAAC;IACjD,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE;YACR,cAAc,EACZ,wFAAwF;SAC3F;QACD,MAAM,EAAE,EAAE;KACX;IACD,cAAc,EAAE,EAAE;IAClB,MAAM,CAAC,OAAO;QACZ,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAChD,UAAU,CAAC,GAAG,GAAG,MAAM,CAAC;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC;QAC5E,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAEpD,MAAM,UAAU,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,aAAa,GAAG,0BAA0B,CAAC,UAAU,CAAC,CAAC;QAE7D,MAAM,YAAY,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAElF,OAAO;YACL,OAAO,CAAC,IAAI;gBACV,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;oBACjC,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI;wBACJ,GAAG,EAAE;4BACH,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;4BAC7B,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;yBAC5B;wBACD,SAAS,EAAE,gBAAgB;wBAC3B,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE;qBACjD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC","sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\n\nimport { ESLintUtils } from '@typescript-eslint/utils';\n\nfunction extractSqlBlockDefinitions(sqlContent: string): Set<string> {\n  const regex = / *-- *BLOCK +([^ \\n]+) */g;\n  const defs = new Set<string>();\n  let match;\n  while ((match = regex.exec(sqlContent)) !== null) {\n    defs.add(match[1]);\n  }\n  return defs;\n}\n\nfunction extractSqlBlockReferences(tsContent: string): Set<string> {\n  const regex = /sql\\.([a-zA-Z0-9_]+)/g;\n  const refs = new Set<string>();\n  let match;\n  while ((match = regex.exec(tsContent)) !== null) {\n    refs.add(match[1]);\n  }\n  return refs;\n}\n\nexport default ESLintUtils.RuleCreator.withoutDocs({\n  meta: {\n    type: 'problem',\n    messages: {\n      unusedSqlBlock:\n        'SQL block \"{{block}}\" in \"{{sqlFile}}\" is not used in this file and should be deleted.',\n    },\n    schema: [],\n  },\n  defaultOptions: [],\n  create(context) {\n    const components = path.parse(context.filename);\n    components.ext = '.sql';\n    const sqlFile = path.join(components.dir, components.name) + components.ext;\n    if (!fs.existsSync(sqlFile)) return {};\n    const tsContent = fs.readFileSync(context.filename, 'utf8');\n    const sqlContent = fs.readFileSync(sqlFile, 'utf8');\n\n    const usedBlocks = extractSqlBlockReferences(tsContent);\n    const definedBlocks = extractSqlBlockDefinitions(sqlContent);\n\n    const unusedBlocks = [...definedBlocks].filter((block) => !usedBlocks.has(block));\n\n    return {\n      Program(node) {\n        for (const block of unusedBlocks) {\n          context.report({\n            node,\n            loc: {\n              start: { line: 1, column: 1 },\n              end: { line: 2, column: 0 },\n            },\n            messageId: 'unusedSqlBlock',\n            data: { block, sqlFile: path.basename(sqlFile) },\n          });\n        }\n      },\n    };\n  },\n});\n"]}
+{"version":3,"file":"no-unused-sql-blocks.js","sourceRoot":"","sources":["../../src/rules/no-unused-sql-blocks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,SAAS,0BAA0B,CAAC,UAAkB;IACpD,MAAM,KAAK,GAAG,2BAA2B,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,KAAK,CAAC;IACV,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,yBAAyB,CAAC,SAAiB;IAClD,MAAM,KAAK,GAAG,uBAAuB,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,KAAK,CAAC;IACV,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,eAAe,WAAW,CAAC,WAAW,CAAC,WAAW,CAAC;IACjD,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE;YACR,cAAc,EACZ,wFAAwF;SAC3F;QACD,MAAM,EAAE,EAAE;KACX;IACD,cAAc,EAAE,EAAE;IAClB,MAAM,CAAC,OAAO;QACZ,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAChD,UAAU,CAAC,GAAG,GAAG,MAAM,CAAC;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC;QAC5E,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAEpD,MAAM,UAAU,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,aAAa,GAAG,0BAA0B,CAAC,UAAU,CAAC,CAAC;QAE7D,MAAM,YAAY,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAElF,OAAO;YACL,OAAO,CAAC,IAAI;gBACV,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;oBACjC,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI;wBACJ,GAAG,EAAE;4BACH,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;4BAC7B,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;yBAC5B;wBACD,SAAS,EAAE,gBAAgB;wBAC3B,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE;qBACjD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC","sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\n\nimport { ESLintUtils } from '@typescript-eslint/utils';\n\nfunction extractSqlBlockDefinitions(sqlContent: string): Set<string> {\n  const regex = / *-- *BLOCK +([^ \\n]+) */g;\n  const defs = new Set<string>();\n  let match;\n  while ((match = regex.exec(sqlContent)) !== null) {\n    defs.add(match[1]);\n  }\n  return defs;\n}\n\nfunction extractSqlBlockReferences(tsContent: string): Set<string> {\n  const regex = /sql\\.([a-zA-Z0-9_]+)/g;\n  const refs = new Set<string>();\n  let match;\n  while ((match = regex.exec(tsContent)) !== null) {\n    refs.add(match[1]);\n  }\n  return refs;\n}\n\nexport default ESLintUtils.RuleCreator.withoutDocs({\n  meta: {\n    type: 'problem',\n    messages: {\n      unusedSqlBlock:\n        'SQL block \"{{block}}\" in \"{{sqlFile}}\" is not used in this file and should be deleted.',\n    },\n    schema: [],\n  },\n  defaultOptions: [],\n  create(context) {\n    const components = path.parse(context.filename);\n    components.ext = '.sql';\n    const sqlFile = path.join(components.dir, components.name) + components.ext;\n    if (!fs.existsSync(sqlFile)) return {};\n    const tsContent = fs.readFileSync(context.filename, 'utf8');\n    const sqlContent = fs.readFileSync(sqlFile, 'utf8');\n\n    const usedBlocks = extractSqlBlockReferences(tsContent);\n    const definedBlocks = extractSqlBlockDefinitions(sqlContent);\n\n    const unusedBlocks = [...definedBlocks].filter((block) => !usedBlocks.has(block));\n\n    return {\n      Program(node) {\n        for (const block of unusedBlocks) {\n          context.report({\n            node,\n            loc: {\n              start: { line: 1, column: 1 },\n              end: { line: 2, column: 0 },\n            },\n            messageId: 'unusedSqlBlock',\n            data: { block, sqlFile: path.basename(sqlFile) },\n          });\n        }\n      },\n    };\n  },\n});\n"]}

package/dist/rules/require-trpc-permission-middleware.d.ts

@@ -0,0 +1,4 @@
+import { ESLintUtils } from '@typescript-eslint/utils';
+declare const _default: ESLintUtils.RuleModule<"missingPermissionMiddleware", [], unknown, ESLintUtils.RuleListener>;
+export default _default;
+//# sourceMappingURL=require-trpc-permission-middleware.d.ts.map

package/dist/rules/require-trpc-permission-middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-trpc-permission-middleware.d.ts","sourceRoot":"","sources":["../../src/rules/require-trpc-permission-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,WAAW,EAAgC,MAAM,0BAA0B,CAAC","sourcesContent":["import { ASTUtils, ESLintUtils, type TSESLint, type TSESTree } from '@typescript-eslint/utils';\n\nconst { findVariable } = ASTUtils;\n\n/**\n * tRPC procedures must enforce their own authorization via a `require*`\n * permission middleware in the chain.\n * Individual procedures often need stricter permissions than the page they're\n * mounted under (e.g. an Edit-only mutation under a route that allows View).\n * Requiring an explicit permission middleware per procedure makes the\n * authz gate visible at the call site and helps prevent missing permission checks.\n *\n * Bad:\n * ```ts\n * const list = t.procedure.query(async ({ ctx }) => { ... });\n * ```\n *\n * Good:\n * ```ts\n * const list = t.procedure.use(requireCoursePermissionEdit).query(...);\n * ```\n *\n * Recognized permission middlewares:\n * - requireCoursePermissionPreview / View / Edit / Own\n * - requireCourseInstancePermissionPreview / View / Edit / Own\n * - requireAdministrator\n *\n * Feature gates like `requireEnhancedAccessControl` and `requireAiGradingFeature`\n * don't count — they must be paired with a permission middleware.\n *\n * The rule follows intermediate procedure-base variables so patterns like\n * `const protected = t.procedure.use(...); ...; protected.query(...)` are\n * checked end-to-end.\n */\n\n// TODO: This list requires manual maintenance. We should consider making feature gates\n// not use the `require` prefix, and then we can use a more generic pattern here.\nconst PERMISSION_MIDDLEWARE_PATTERN =\n  /^require(Course|CourseInstance)Permission(Preview|View|Edit|Own)$|^requireAdministrator$/;\nconst TERMINAL_METHODS = new Set(['query', 'mutation', 'subscription']);\n\nfunction unwrapMemberObject(expr: TSESTree.Expression): TSESTree.Expression {\n  return expr.type === 'TSNonNullExpression' || expr.type === 'TSAsExpression'\n    ? unwrapMemberObject(expr.expression)\n    : expr;\n}\n\nfunction isTProcedure(expr: TSESTree.Expression): boolean {\n  return (\n    expr.type === 'MemberExpression' &&\n    !expr.computed &&\n    expr.property.type === 'Identifier' &&\n    expr.property.name === 'procedure' &&\n    expr.object.type === 'Identifier' &&\n    expr.object.name === 't'\n  );\n}\n\ninterface ChainInfo {\n  matchesTProcedure: boolean;\n  middlewares: string[];\n}\n\n/**\n * Walks back through a chain like `expr.use(A).input(B).use(C)` collecting\n * `.use(...)` argument identifiers. If the base of the chain is `t.procedure`,\n * returns the collected middlewares. If the base is a variable, follows the\n * variable's initializer (e.g. `const protected = t.procedure.use(X)`).\n */\nfunction getProcedureChainInfo(\n  expr: TSESTree.Expression,\n  scope: TSESLint.Scope.Scope,\n  visited: Set<TSESTree.Node>,\n): ChainInfo {\n  if (visited.has(expr)) return { matchesTProcedure: false, middlewares: [] };\n  visited.add(expr);\n\n  const middlewares: string[] = [];\n  let cursor: TSESTree.Expression = expr;\n\n  while (cursor.type === 'CallExpression') {\n    const callee = cursor.callee;\n    if (\n      callee.type !== 'MemberExpression' ||\n      callee.computed ||\n      callee.property.type !== 'Identifier'\n    ) {\n      return { matchesTProcedure: false, middlewares: [] };\n    }\n    if (callee.property.name === 'use' && cursor.arguments[0]?.type === 'Identifier') {\n      middlewares.push(cursor.arguments[0].name);\n    }\n    cursor = callee.object;\n  }\n\n  cursor = unwrapMemberObject(cursor);\n\n  if (isTProcedure(cursor)) {\n    return { matchesTProcedure: true, middlewares };\n  }\n\n  // Follow an intermediate procedure-base variable defined in the same module:\n  //   const protectedProcedure = t.procedure.use(...);\n  //   protectedProcedure.query(...);\n  if (cursor.type === 'Identifier') {\n    const variable = findVariable(scope, cursor);\n    if (variable && variable.defs.length === 1) {\n      const def = variable.defs[0];\n      if (\n        def.node.type === 'VariableDeclarator' &&\n        def.node.init &&\n        // Conservative: only follow `const` bindings to avoid stale data\n        // from let/var rebinding.\n        def.parent?.type === 'VariableDeclaration' &&\n        def.parent.kind === 'const'\n      ) {\n        const upstream = getProcedureChainInfo(def.node.init, scope, visited);\n        if (upstream.matchesTProcedure) {\n          return {\n            matchesTProcedure: true,\n            middlewares: [...middlewares, ...upstream.middlewares],\n          };\n        }\n      }\n    }\n  }\n\n  return { matchesTProcedure: false, middlewares: [] };\n}\n\nexport default ESLintUtils.RuleCreator.withoutDocs({\n  meta: {\n    type: 'problem',\n    messages: {\n      missingPermissionMiddleware:\n        'tRPC procedure must call .use() with a permission middleware (e.g. requireCoursePermissionEdit)',\n    },\n    schema: [],\n  },\n  defaultOptions: [],\n\n  create(context) {\n    return {\n      CallExpression(node) {\n        if (\n          node.callee.type !== 'MemberExpression' ||\n          node.callee.computed ||\n          node.callee.property.type !== 'Identifier' ||\n          !TERMINAL_METHODS.has(node.callee.property.name)\n        ) {\n          return;\n        }\n\n        const scope = context.sourceCode.getScope(node);\n        const info = getProcedureChainInfo(node.callee.object, scope, new Set());\n\n        if (!info.matchesTProcedure) return;\n\n        const hasPermissionGate = info.middlewares.some((name) =>\n          PERMISSION_MIDDLEWARE_PATTERN.test(name),\n        );\n        if (!hasPermissionGate) {\n          context.report({ node, messageId: 'missingPermissionMiddleware' });\n        }\n      },\n    };\n  },\n});\n"]}

package/dist/rules/require-trpc-permission-middleware.js

@@ -0,0 +1,133 @@
+import { ASTUtils, ESLintUtils } from '@typescript-eslint/utils';
+const { findVariable } = ASTUtils;
+/**
+ * tRPC procedures must enforce their own authorization via a `require*`
+ * permission middleware in the chain.
+ * Individual procedures often need stricter permissions than the page they're
+ * mounted under (e.g. an Edit-only mutation under a route that allows View).
+ * Requiring an explicit permission middleware per procedure makes the
+ * authz gate visible at the call site and helps prevent missing permission checks.
+ *
+ * Bad:
+ * ```ts
+ * const list = t.procedure.query(async ({ ctx }) => { ... });
+ * ```
+ *
+ * Good:
+ * ```ts
+ * const list = t.procedure.use(requireCoursePermissionEdit).query(...);
+ * ```
+ *
+ * Recognized permission middlewares:
+ * - requireCoursePermissionPreview / View / Edit / Own
+ * - requireCourseInstancePermissionPreview / View / Edit / Own
+ * - requireAdministrator
+ *
+ * Feature gates like `requireEnhancedAccessControl` and `requireAiGradingFeature`
+ * don't count — they must be paired with a permission middleware.
+ *
+ * The rule follows intermediate procedure-base variables so patterns like
+ * `const protected = t.procedure.use(...); ...; protected.query(...)` are
+ * checked end-to-end.
+ */
+// TODO: This list requires manual maintenance. We should consider making feature gates
+// not use the `require` prefix, and then we can use a more generic pattern here.
+const PERMISSION_MIDDLEWARE_PATTERN = /^require(Course|CourseInstance)Permission(Preview|View|Edit|Own)$|^requireAdministrator$/;
+const TERMINAL_METHODS = new Set(['query', 'mutation', 'subscription']);
+function unwrapMemberObject(expr) {
+    return expr.type === 'TSNonNullExpression' || expr.type === 'TSAsExpression'
+        ? unwrapMemberObject(expr.expression)
+        : expr;
+}
+function isTProcedure(expr) {
+    return (expr.type === 'MemberExpression' &&
+        !expr.computed &&
+        expr.property.type === 'Identifier' &&
+        expr.property.name === 'procedure' &&
+        expr.object.type === 'Identifier' &&
+        expr.object.name === 't');
+}
+/**
+ * Walks back through a chain like `expr.use(A).input(B).use(C)` collecting
+ * `.use(...)` argument identifiers. If the base of the chain is `t.procedure`,
+ * returns the collected middlewares. If the base is a variable, follows the
+ * variable's initializer (e.g. `const protected = t.procedure.use(X)`).
+ */
+function getProcedureChainInfo(expr, scope, visited) {
+    if (visited.has(expr))
+        return { matchesTProcedure: false, middlewares: [] };
+    visited.add(expr);
+    const middlewares = [];
+    let cursor = expr;
+    while (cursor.type === 'CallExpression') {
+        const callee = cursor.callee;
+        if (callee.type !== 'MemberExpression' ||
+            callee.computed ||
+            callee.property.type !== 'Identifier') {
+            return { matchesTProcedure: false, middlewares: [] };
+        }
+        if (callee.property.name === 'use' && cursor.arguments[0]?.type === 'Identifier') {
+            middlewares.push(cursor.arguments[0].name);
+        }
+        cursor = callee.object;
+    }
+    cursor = unwrapMemberObject(cursor);
+    if (isTProcedure(cursor)) {
+        return { matchesTProcedure: true, middlewares };
+    }
+    // Follow an intermediate procedure-base variable defined in the same module:
+    //   const protectedProcedure = t.procedure.use(...);
+    //   protectedProcedure.query(...);
+    if (cursor.type === 'Identifier') {
+        const variable = findVariable(scope, cursor);
+        if (variable && variable.defs.length === 1) {
+            const def = variable.defs[0];
+            if (def.node.type === 'VariableDeclarator' &&
+                def.node.init &&
+                // Conservative: only follow `const` bindings to avoid stale data
+                // from let/var rebinding.
+                def.parent?.type === 'VariableDeclaration' &&
+                def.parent.kind === 'const') {
+                const upstream = getProcedureChainInfo(def.node.init, scope, visited);
+                if (upstream.matchesTProcedure) {
+                    return {
+                        matchesTProcedure: true,
+                        middlewares: [...middlewares, ...upstream.middlewares],
+                    };
+                }
+            }
+        }
+    }
+    return { matchesTProcedure: false, middlewares: [] };
+}
+export default ESLintUtils.RuleCreator.withoutDocs({
+    meta: {
+        type: 'problem',
+        messages: {
+            missingPermissionMiddleware: 'tRPC procedure must call .use() with a permission middleware (e.g. requireCoursePermissionEdit)',
+        },
+        schema: [],
+    },
+    defaultOptions: [],
+    create(context) {
+        return {
+            CallExpression(node) {
+                if (node.callee.type !== 'MemberExpression' ||
+                    node.callee.computed ||
+                    node.callee.property.type !== 'Identifier' ||
+                    !TERMINAL_METHODS.has(node.callee.property.name)) {
+                    return;
+                }
+                const scope = context.sourceCode.getScope(node);
+                const info = getProcedureChainInfo(node.callee.object, scope, new Set());
+                if (!info.matchesTProcedure)
+                    return;
+                const hasPermissionGate = info.middlewares.some((name) => PERMISSION_MIDDLEWARE_PATTERN.test(name));
+                if (!hasPermissionGate) {
+                    context.report({ node, messageId: 'missingPermissionMiddleware' });
+                }
+            },
+        };
+    },
+});
+//# sourceMappingURL=require-trpc-permission-middleware.js.map

package/dist/rules/require-trpc-permission-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-trpc-permission-middleware.js","sourceRoot":"","sources":["../../src/rules/require-trpc-permission-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAgC,MAAM,0BAA0B,CAAC;AAE/F,MAAM,EAAE,YAAY,EAAE,GAAG,QAAQ,CAAC;AAElC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,uFAAuF;AACvF,iFAAiF;AACjF,MAAM,6BAA6B,GACjC,0FAA0F,CAAC;AAC7F,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;AAExE,SAAS,kBAAkB,CAAC,IAAyB;IACnD,OAAO,IAAI,CAAC,IAAI,KAAK,qBAAqB,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB;QAC1E,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC;QACrC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,YAAY,CAAC,IAAyB;IAC7C,OAAO,CACL,IAAI,CAAC,IAAI,KAAK,kBAAkB;QAChC,CAAC,IAAI,CAAC,QAAQ;QACd,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;QACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,WAAW;QAClC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;QACjC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG,CACzB,CAAC;AACJ,CAAC;AAOD;;;;;GAKG;AACH,SAAS,qBAAqB,CAC5B,IAAyB,EACzB,KAA2B,EAC3B,OAA2B;IAE3B,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAElB,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,MAAM,GAAwB,IAAI,CAAC;IAEvC,OAAO,MAAM,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,IACE,MAAM,CAAC,IAAI,KAAK,kBAAkB;YAClC,MAAM,CAAC,QAAQ;YACf,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY,EACrC,CAAC;YACD,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;QACvD,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;YACjF,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IACzB,CAAC;IAED,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAEpC,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAClD,CAAC;IAED,6EAA6E;IAC7E,qDAAqD;IACrD,mCAAmC;IACnC,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC7B,IACE,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,oBAAoB;gBACtC,GAAG,CAAC,IAAI,CAAC,IAAI;gBACb,iEAAiE;gBACjE,0BAA0B;gBAC1B,GAAG,CAAC,MAAM,EAAE,IAAI,KAAK,qBAAqB;gBAC1C,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,EAC3B,CAAC;gBACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;gBACtE,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;oBAC/B,OAAO;wBACL,iBAAiB,EAAE,IAAI;wBACvB,WAAW,EAAE,CAAC,GAAG,WAAW,EAAE,GAAG,QAAQ,CAAC,WAAW,CAAC;qBACvD,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AACvD,CAAC;AAED,eAAe,WAAW,CAAC,WAAW,CAAC,WAAW,CAAC;IACjD,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE;YACR,2BAA2B,EACzB,iGAAiG;SACpG;QACD,MAAM,EAAE,EAAE;KACX;IACD,cAAc,EAAE,EAAE;IAElB,MAAM,CAAC,OAAO;QACZ,OAAO;YACL,cAAc,CAAC,IAAI;gBACjB,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB;oBACvC,IAAI,CAAC,MAAM,CAAC,QAAQ;oBACpB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;oBAC1C,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAChD,CAAC;oBACD,OAAO;gBACT,CAAC;gBAED,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAChD,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;gBAEzE,IAAI,CAAC,IAAI,CAAC,iBAAiB;oBAAE,OAAO;gBAEpC,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACvD,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CACzC,CAAC;gBACF,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBACvB,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,6BAA6B,EAAE,CAAC,CAAC;gBACrE,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { ASTUtils, ESLintUtils, type TSESLint, type TSESTree } from '@typescript-eslint/utils';\n\nconst { findVariable } = ASTUtils;\n\n/**\n * tRPC procedures must enforce their own authorization via a `require*`\n * permission middleware in the chain.\n * Individual procedures often need stricter permissions than the page they're\n * mounted under (e.g. an Edit-only mutation under a route that allows View).\n * Requiring an explicit permission middleware per procedure makes the\n * authz gate visible at the call site and helps prevent missing permission checks.\n *\n * Bad:\n * ```ts\n * const list = t.procedure.query(async ({ ctx }) => { ... });\n * ```\n *\n * Good:\n * ```ts\n * const list = t.procedure.use(requireCoursePermissionEdit).query(...);\n * ```\n *\n * Recognized permission middlewares:\n * - requireCoursePermissionPreview / View / Edit / Own\n * - requireCourseInstancePermissionPreview / View / Edit / Own\n * - requireAdministrator\n *\n * Feature gates like `requireEnhancedAccessControl` and `requireAiGradingFeature`\n * don't count — they must be paired with a permission middleware.\n *\n * The rule follows intermediate procedure-base variables so patterns like\n * `const protected = t.procedure.use(...); ...; protected.query(...)` are\n * checked end-to-end.\n */\n\n// TODO: This list requires manual maintenance. We should consider making feature gates\n// not use the `require` prefix, and then we can use a more generic pattern here.\nconst PERMISSION_MIDDLEWARE_PATTERN =\n  /^require(Course|CourseInstance)Permission(Preview|View|Edit|Own)$|^requireAdministrator$/;\nconst TERMINAL_METHODS = new Set(['query', 'mutation', 'subscription']);\n\nfunction unwrapMemberObject(expr: TSESTree.Expression): TSESTree.Expression {\n  return expr.type === 'TSNonNullExpression' || expr.type === 'TSAsExpression'\n    ? unwrapMemberObject(expr.expression)\n    : expr;\n}\n\nfunction isTProcedure(expr: TSESTree.Expression): boolean {\n  return (\n    expr.type === 'MemberExpression' &&\n    !expr.computed &&\n    expr.property.type === 'Identifier' &&\n    expr.property.name === 'procedure' &&\n    expr.object.type === 'Identifier' &&\n    expr.object.name === 't'\n  );\n}\n\ninterface ChainInfo {\n  matchesTProcedure: boolean;\n  middlewares: string[];\n}\n\n/**\n * Walks back through a chain like `expr.use(A).input(B).use(C)` collecting\n * `.use(...)` argument identifiers. If the base of the chain is `t.procedure`,\n * returns the collected middlewares. If the base is a variable, follows the\n * variable's initializer (e.g. `const protected = t.procedure.use(X)`).\n */\nfunction getProcedureChainInfo(\n  expr: TSESTree.Expression,\n  scope: TSESLint.Scope.Scope,\n  visited: Set<TSESTree.Node>,\n): ChainInfo {\n  if (visited.has(expr)) return { matchesTProcedure: false, middlewares: [] };\n  visited.add(expr);\n\n  const middlewares: string[] = [];\n  let cursor: TSESTree.Expression = expr;\n\n  while (cursor.type === 'CallExpression') {\n    const callee = cursor.callee;\n    if (\n      callee.type !== 'MemberExpression' ||\n      callee.computed ||\n      callee.property.type !== 'Identifier'\n    ) {\n      return { matchesTProcedure: false, middlewares: [] };\n    }\n    if (callee.property.name === 'use' && cursor.arguments[0]?.type === 'Identifier') {\n      middlewares.push(cursor.arguments[0].name);\n    }\n    cursor = callee.object;\n  }\n\n  cursor = unwrapMemberObject(cursor);\n\n  if (isTProcedure(cursor)) {\n    return { matchesTProcedure: true, middlewares };\n  }\n\n  // Follow an intermediate procedure-base variable defined in the same module:\n  //   const protectedProcedure = t.procedure.use(...);\n  //   protectedProcedure.query(...);\n  if (cursor.type === 'Identifier') {\n    const variable = findVariable(scope, cursor);\n    if (variable && variable.defs.length === 1) {\n      const def = variable.defs[0];\n      if (\n        def.node.type === 'VariableDeclarator' &&\n        def.node.init &&\n        // Conservative: only follow `const` bindings to avoid stale data\n        // from let/var rebinding.\n        def.parent?.type === 'VariableDeclaration' &&\n        def.parent.kind === 'const'\n      ) {\n        const upstream = getProcedureChainInfo(def.node.init, scope, visited);\n        if (upstream.matchesTProcedure) {\n          return {\n            matchesTProcedure: true,\n            middlewares: [...middlewares, ...upstream.middlewares],\n          };\n        }\n      }\n    }\n  }\n\n  return { matchesTProcedure: false, middlewares: [] };\n}\n\nexport default ESLintUtils.RuleCreator.withoutDocs({\n  meta: {\n    type: 'problem',\n    messages: {\n      missingPermissionMiddleware:\n        'tRPC procedure must call .use() with a permission middleware (e.g. requireCoursePermissionEdit)',\n    },\n    schema: [],\n  },\n  defaultOptions: [],\n\n  create(context) {\n    return {\n      CallExpression(node) {\n        if (\n          node.callee.type !== 'MemberExpression' ||\n          node.callee.computed ||\n          node.callee.property.type !== 'Identifier' ||\n          !TERMINAL_METHODS.has(node.callee.property.name)\n        ) {\n          return;\n        }\n\n        const scope = context.sourceCode.getScope(node);\n        const info = getProcedureChainInfo(node.callee.object, scope, new Set());\n\n        if (!info.matchesTProcedure) return;\n\n        const hasPermissionGate = info.middlewares.some((name) =>\n          PERMISSION_MIDDLEWARE_PATTERN.test(name),\n        );\n        if (!hasPermissionGate) {\n          context.report({ node, messageId: 'missingPermissionMiddleware' });\n        }\n      },\n    };\n  },\n});\n"]}

package/dist/rules/safe-db-types.d.ts

@@ -1,6 +1,6 @@
 import { ESLintUtils } from '@typescript-eslint/utils';
 declare const _default: ESLintUtils.RuleModule<"spreadAttributes" | "unsafeTypes", [({
-    allowDbTypes?: (string | RegExp)[] | undefined;
+    allowDbTypes?: (string | RegExp)[];
 } | undefined)?], unknown, ESLintUtils.RuleListener>;
 export default _default;
 //# sourceMappingURL=safe-db-types.d.ts.map

package/dist/rules/safe-db-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safe-db-types.d.ts","sourceRoot":"","sources":["../../src/rules/safe-db-types.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;;;;AAifvD,wBAsGG","sourcesContent":["import { type TSESTree } from '@typescript-eslint/types';\nimport { ESLintUtils } from '@typescript-eslint/utils';\nimport * as ts from 'typescript';\n\nconst HYDRATE_FUNCTION_NAME = 'hydrateHtml';\nconst HYDRATE_COMPONENT_NAME = 'Hydrate';\n\n/**\n * Check if a variable declaration is a Zod schema that uses schemas from db-types.ts\n * For example: const RubricDataSchema = RubricSchema.extend({...})\n */\nfunction checkZodSchemaForDbTypes(\n  declaration: ts.VariableDeclaration,\n  typeChecker: ts.TypeChecker,\n): string[] {\n  const violations: string[] = [];\n\n  if (!declaration.initializer) return violations;\n\n  // Walk the expression tree to find all identifiers\n  const findIdentifiers = (node: ts.Node): void => {\n    // Check property access expressions like RubricSchema.extend() or InstanceQuestionSchema.shape\n    if (ts.isPropertyAccessExpression(node)) {\n      const objectSymbol = typeChecker.getSymbolAtLocation(node.expression);\n      if (objectSymbol) {\n        const aliasedSymbol =\n          objectSymbol.flags & ts.SymbolFlags.Alias\n            ? typeChecker.getAliasedSymbol(objectSymbol)\n            : objectSymbol;\n        const decls = aliasedSymbol.getDeclarations();\n        if (decls && decls.length > 0) {\n          const sourceFile = decls[0].getSourceFile();\n          if (sourceFile.fileName.endsWith('/db-types.ts')) {\n            violations.push(aliasedSymbol.getName());\n          }\n        }\n      }\n    }\n\n    // Check spread elements in object literals (e.g., ...SomeSchema.shape)\n    if (ts.isSpreadAssignment(node)) {\n      // The expression being spread (e.g., SomeSchema.shape)\n      const spreadExpr = node.expression;\n\n      // Check if it's a property access (e.g., accessing .shape)\n      if (ts.isPropertyAccessExpression(spreadExpr)) {\n        const objectSymbol = typeChecker.getSymbolAtLocation(spreadExpr.expression);\n        if (objectSymbol) {\n          const aliasedSymbol =\n            objectSymbol.flags & ts.SymbolFlags.Alias\n              ? typeChecker.getAliasedSymbol(objectSymbol)\n              : objectSymbol;\n          const decls = aliasedSymbol.getDeclarations();\n          if (decls && decls.length > 0) {\n            const sourceFile = decls[0].getSourceFile();\n            if (sourceFile.fileName.endsWith('/db-types.ts')) {\n              violations.push(aliasedSymbol.getName());\n            } else {\n              // The schema is defined locally, check if IT uses db-types\n              for (const decl of decls) {\n                if (ts.isVariableDeclaration(decl)) {\n                  // Recursively check the local schema\n                  const nestedViolations = checkZodSchemaForDbTypes(decl, typeChecker);\n                  violations.push(...nestedViolations);\n                }\n              }\n            }\n          }\n        }\n      }\n      // Also check if the spread is a direct identifier (e.g., ...someObject)\n      else if (ts.isIdentifier(spreadExpr)) {\n        const spreadSymbol = typeChecker.getSymbolAtLocation(spreadExpr);\n        if (spreadSymbol) {\n          const aliasedSymbol =\n            spreadSymbol.flags & ts.SymbolFlags.Alias\n              ? typeChecker.getAliasedSymbol(spreadSymbol)\n              : spreadSymbol;\n          const decls = aliasedSymbol.getDeclarations();\n          if (decls && decls.length > 0) {\n            const sourceFile = decls[0].getSourceFile();\n            if (sourceFile.fileName.endsWith('/db-types.ts')) {\n              violations.push(aliasedSymbol.getName());\n            }\n          }\n        }\n      }\n    }\n\n    // Check call expressions for arguments\n    if (ts.isCallExpression(node)) {\n      for (const arg of node.arguments) {\n        // Check if argument is an identifier (e.g., RubricItemSchema)\n        if (ts.isIdentifier(arg)) {\n          const argSymbol = typeChecker.getSymbolAtLocation(arg);\n          if (argSymbol) {\n            const aliasedSymbol =\n              argSymbol.flags & ts.SymbolFlags.Alias\n                ? typeChecker.getAliasedSymbol(argSymbol)\n                : argSymbol;\n            const decls = aliasedSymbol.getDeclarations();\n            if (decls && decls.length > 0) {\n              const sourceFile = decls[0].getSourceFile();\n              if (sourceFile.fileName.endsWith('/db-types.ts')) {\n                violations.push(aliasedSymbol.getName());\n              }\n            }\n          }\n        }\n      }\n    }\n\n    // Check object literal property assignments (e.g., { rubric: RubricSchema })\n    if (ts.isPropertyAssignment(node) && ts.isIdentifier(node.initializer)) {\n      const identifier = node.initializer;\n      const symbol = typeChecker.getSymbolAtLocation(identifier);\n      if (symbol) {\n        const aliasedSymbol =\n          symbol.flags & ts.SymbolFlags.Alias ? typeChecker.getAliasedSymbol(symbol) : symbol;\n        const decls = aliasedSymbol.getDeclarations();\n        if (decls && decls.length > 0) {\n          const sourceFile = decls[0].getSourceFile();\n          if (sourceFile.fileName.endsWith('/db-types.ts')) {\n            violations.push(aliasedSymbol.getName());\n          }\n        }\n      }\n    }\n\n    ts.forEachChild(node, findIdentifiers);\n  };\n\n  findIdentifiers(declaration.initializer);\n  return violations;\n}\n\n/**\n * Check if a type node is z.infer<typeof SchemaName> and if SchemaName uses db-types\n * Returns the names of db-types that the schema depends on\n */\nfunction checkForZodInferPattern(typeNode: ts.TypeNode, typeChecker: ts.TypeChecker): string[] {\n  // Check if this is a type reference with type arguments\n  if (!ts.isTypeReferenceNode(typeNode)) return [];\n\n  // Check if the type reference is named (e.g., \"infer\" from z.infer)\n  const typeName = typeNode.typeName;\n  if (!ts.isQualifiedName(typeName)) return [];\n\n  // Check if it's z.infer or similar pattern\n  // The pattern is: z.infer<typeof SchemaName>\n  const typeArgs = typeNode.typeArguments;\n  if (!typeArgs || typeArgs.length !== 1) return [];\n\n  const typeArg = typeArgs[0];\n\n  // Check if the type argument is a typeof expression\n  if (!ts.isTypeQueryNode(typeArg)) return [];\n\n  // Get the schema name from typeof X\n  const exprName = typeArg.exprName;\n  if (!ts.isIdentifier(exprName)) return [];\n\n  // Now find the schema variable declaration\n  const schemaSymbol = typeChecker.getSymbolAtLocation(exprName);\n  if (!schemaSymbol) return [];\n\n  // Check if this is an imported symbol (alias) - follow it to the original\n  const symbolToCheck =\n    schemaSymbol.flags & ts.SymbolFlags.Alias\n      ? typeChecker.getAliasedSymbol(schemaSymbol)\n      : schemaSymbol;\n\n  const schemaDecls = symbolToCheck.getDeclarations();\n  if (!schemaDecls || schemaDecls.length === 0) return [];\n\n  // Check if it's a variable declaration\n  for (const decl of schemaDecls) {\n    if (ts.isVariableDeclaration(decl)) {\n      // If the schema is defined in safe-db-types.ts, it's safe by definition\n      const sourceFile = decl.getSourceFile();\n      if (sourceFile.fileName.endsWith('/safe-db-types.ts')) {\n        return [];\n      }\n\n      // Use our existing helper to check if the schema uses db-types\n      return checkZodSchemaForDbTypes(decl, typeChecker);\n    }\n  }\n\n  return [];\n}\n\nfunction extractChild(children: TSESTree.JSXChild[]): TSESTree.JSXElement | null {\n  const nonWhitespaceChildren = children.filter((child) => {\n    if (child.type === 'JSXText') {\n      return child.value.trim().length > 0;\n    }\n    return true;\n  });\n\n  if (nonWhitespaceChildren.length !== 1 || nonWhitespaceChildren[0].type !== 'JSXElement') {\n    return null;\n  }\n\n  return nonWhitespaceChildren[0];\n}\n\n/**\n * Check if a TypeScript type node references a type from db-types.ts\n * This checks the actual source code type annotation, not the resolved type.\n * Follows type aliases (imports) to their original declaration.\n * Returns all unsafe type names found.\n */\nfunction checkTypeNodeForDbTypes(\n  typeNode: ts.TypeNode,\n  typeChecker: ts.TypeChecker,\n  visited = new Set<ts.TypeNode>(),\n): string[] {\n  if (visited.has(typeNode)) return [];\n  visited.add(typeNode);\n\n  const violations: string[] = [];\n\n  // Check type references (e.g., User, Course, AuthnProvider)\n  if (ts.isTypeReferenceNode(typeNode)) {\n    const typeName = typeNode.typeName;\n    const symbol = typeChecker.getSymbolAtLocation(typeName);\n\n    if (symbol) {\n      // Check if this is an imported symbol (alias) - follow it to the original\n      const symbolToCheck =\n        symbol.flags & ts.SymbolFlags.Alias ? typeChecker.getAliasedSymbol(symbol) : symbol;\n\n      const declarations = symbolToCheck.getDeclarations();\n      if (declarations && declarations.length > 0) {\n        for (const decl of declarations) {\n          const sourceFile = decl.getSourceFile();\n          if (sourceFile.fileName.endsWith('/db-types.ts')) {\n            // Found a type from db-types.ts!\n            violations.push(symbolToCheck.getName());\n          } else {\n            // If it's a type alias or interface defined locally, check its properties\n            if (ts.isTypeAliasDeclaration(decl) && decl.type) {\n              // Special case: Check if this is z.infer<typeof XxxSchema>\n              const zodSchemaViolations = checkForZodInferPattern(decl.type, typeChecker);\n              violations.push(...zodSchemaViolations);\n\n              // Also check the type itself\n              const nestedViolations = checkTypeNodeForDbTypes(decl.type, typeChecker, visited);\n              violations.push(...nestedViolations);\n            } else if (ts.isInterfaceDeclaration(decl)) {\n              // Check interface members\n              for (const member of decl.members) {\n                if (ts.isPropertySignature(member) && member.type) {\n                  const nestedViolations = checkTypeNodeForDbTypes(\n                    member.type,\n                    typeChecker,\n                    visited,\n                  );\n                  violations.push(...nestedViolations);\n                }\n              }\n            }\n          }\n        }\n      }\n    }\n\n    // Check type arguments (e.g., Array<User>, Promise<Course>)\n    if (typeNode.typeArguments) {\n      for (const typeArg of typeNode.typeArguments) {\n        const nestedViolations = checkTypeNodeForDbTypes(typeArg, typeChecker, visited);\n        violations.push(...nestedViolations);\n      }\n    }\n  }\n\n  // Check array types (e.g., User[])\n  if (ts.isArrayTypeNode(typeNode)) {\n    const nestedViolations = checkTypeNodeForDbTypes(typeNode.elementType, typeChecker, visited);\n    violations.push(...nestedViolations);\n  }\n\n  // Check union types (e.g., User | null)\n  if (ts.isUnionTypeNode(typeNode)) {\n    for (const type of typeNode.types) {\n      const nestedViolations = checkTypeNodeForDbTypes(type, typeChecker, visited);\n      violations.push(...nestedViolations);\n    }\n  }\n\n  // Check intersection types (e.g., User & { extra: string })\n  if (ts.isIntersectionTypeNode(typeNode)) {\n    for (const type of typeNode.types) {\n      const nestedViolations = checkTypeNodeForDbTypes(type, typeChecker, visited);\n      violations.push(...nestedViolations);\n    }\n  }\n\n  // Check object type literals and their properties\n  if (ts.isTypeLiteralNode(typeNode)) {\n    for (const member of typeNode.members) {\n      if (ts.isPropertySignature(member) && member.type) {\n        const nestedViolations = checkTypeNodeForDbTypes(member.type, typeChecker, visited);\n        violations.push(...nestedViolations);\n      }\n    }\n  }\n\n  // Check indexed access types (e.g., User['name'])\n  // These are safe! We're only extracting a specific property, not passing the whole object.\n  // So we DON'T recurse into the object type for indexed access.\n  if (ts.isIndexedAccessTypeNode(typeNode)) {\n    // Do not check - indexed access is safe\n  }\n\n  return violations;\n}\n\n/**\n * Check if a type name is in the allowlist of safe types\n */\nfunction isTypeInAllowlist(typeName: string, allowlist: (string | RegExp)[]): boolean {\n  return allowlist.some((pattern) => {\n    if (typeof pattern === 'string') {\n      return typeName === pattern;\n    }\n    return pattern.test(typeName);\n  });\n}\n\n/**\n * Check the props of a component for unsafe types from db-types.ts\n */\nfunction checkComponentProps({\n  context,\n  typeChecker,\n  componentSymbol,\n  tsComponentNode,\n  jsxElement,\n  reportNode,\n  allowlist,\n}: {\n  context: ReturnType<typeof ESLintUtils.RuleCreator.withoutDocs>['create'] extends (\n    context: infer C,\n  ) => any\n    ? C\n    : never;\n  typeChecker: ts.TypeChecker;\n  componentSymbol: ts.Symbol;\n  tsComponentNode: ts.Node;\n  jsxElement: TSESTree.JSXElement;\n  reportNode: TSESTree.Node;\n  allowlist: (string | RegExp)[];\n}): void {\n  const childOpeningElement = jsxElement.openingElement;\n\n  // Get the component's type (function or class component)\n  const componentType = typeChecker.getTypeOfSymbolAtLocation(componentSymbol, tsComponentNode);\n  const signatures = componentType.getCallSignatures();\n\n  if (signatures.length === 0) return;\n\n  // Get the first parameter (props) of the component function\n  const propsParam = signatures[0].getParameters()[0];\n  if (!propsParam) return;\n\n  const propsDeclaration = propsParam.valueDeclaration;\n\n  if (!propsDeclaration || !ts.isParameter(propsDeclaration)) return;\n\n  // Get the type annotation node from the props parameter\n  const propsTypeNode = propsDeclaration.type;\n  if (!propsTypeNode) return;\n\n  // Check each property in the props type\n  if (ts.isTypeLiteralNode(propsTypeNode)) {\n    // Inline props object: { foo: string; bar: number }\n    for (const member of propsTypeNode.members) {\n      if (ts.isPropertySignature(member) && member.type && member.name) {\n        if (!ts.isIdentifier(member.name)) continue;\n\n        const propName = member.name.text;\n        const violations = checkTypeNodeForDbTypes(member.type, typeChecker);\n\n        if (violations.length > 0) {\n          // Find the JSX attribute for this prop\n          const attribute = childOpeningElement.attributes.find(\n            (attr) =>\n              attr.type === 'JSXAttribute' &&\n              attr.name.type === 'JSXIdentifier' &&\n              attr.name.name === propName,\n          );\n\n          for (const typeName of violations) {\n            if (isTypeInAllowlist(typeName, allowlist)) continue;\n\n            context.report({\n              node: attribute || reportNode,\n              messageId: 'unsafeTypes',\n              data: { propName, typeName },\n            });\n          }\n        }\n      }\n    }\n  } else if (ts.isTypeReferenceNode(propsTypeNode)) {\n    // Props is a type reference (e.g., interface or type alias)\n    const symbol = typeChecker.getSymbolAtLocation(propsTypeNode.typeName);\n    if (symbol) {\n      const resolvedSymbol =\n        symbol.flags & ts.SymbolFlags.Alias ? typeChecker.getAliasedSymbol(symbol) : symbol;\n      const declarations = resolvedSymbol.getDeclarations();\n\n      if (declarations && declarations.length > 0) {\n        for (const decl of declarations) {\n          if (ts.isInterfaceDeclaration(decl) || ts.isTypeLiteralNode(decl)) {\n            const members = ts.isInterfaceDeclaration(decl) ? decl.members : decl.members;\n\n            for (const member of members) {\n              if (ts.isPropertySignature(member) && member.type && member.name) {\n                if (!ts.isIdentifier(member.name)) continue;\n\n                const propName = member.name.text;\n                const violations = checkTypeNodeForDbTypes(member.type, typeChecker);\n\n                if (violations.length > 0) {\n                  // Find the JSX attribute for this prop\n                  const attribute = childOpeningElement.attributes.find(\n                    (attr) =>\n                      attr.type === 'JSXAttribute' &&\n                      attr.name.type === 'JSXIdentifier' &&\n                      attr.name.name === propName,\n                  );\n\n                  for (const typeName of violations) {\n                    if (isTypeInAllowlist(typeName, allowlist)) continue;\n\n                    context.report({\n                      node: attribute || reportNode,\n                      messageId: 'unsafeTypes',\n                      data: { propName, typeName },\n                    });\n                  }\n                }\n              }\n            }\n          } else if (ts.isTypeAliasDeclaration(decl) && decl.type) {\n            // Type alias might be an inline object type\n            if (ts.isTypeLiteralNode(decl.type)) {\n              for (const member of decl.type.members) {\n                if (ts.isPropertySignature(member) && member.type && member.name) {\n                  if (!ts.isIdentifier(member.name)) continue;\n\n                  const propName = member.name.text;\n                  const violations = checkTypeNodeForDbTypes(member.type, typeChecker);\n\n                  if (violations.length > 0) {\n                    // Find the JSX attribute for this prop\n                    const attribute = childOpeningElement.attributes.find(\n                      (attr) =>\n                        attr.type === 'JSXAttribute' &&\n                        attr.name.type === 'JSXIdentifier' &&\n                        attr.name.name === propName,\n                    );\n\n                    for (const typeName of violations) {\n                      if (isTypeInAllowlist(typeName, allowlist)) continue;\n\n                      context.report({\n                        node: attribute || reportNode,\n                        messageId: 'unsafeTypes',\n                        data: { propName, typeName },\n                      });\n                    }\n                  }\n                }\n              }\n            }\n          }\n        }\n      }\n    }\n  }\n\n  // Check for spread attributes\n  const attributes = childOpeningElement.attributes;\n  for (const attr of attributes) {\n    if (attr.type === 'JSXSpreadAttribute') {\n      context.report({\n        node: reportNode,\n        messageId: 'spreadAttributes',\n      });\n      continue;\n    }\n  }\n}\n\nexport default ESLintUtils.RuleCreator.withoutDocs<\n  [{ allowDbTypes?: (string | RegExp)[] }?],\n  'spreadAttributes' | 'unsafeTypes'\n>({\n  meta: {\n    type: 'problem',\n    messages: {\n      spreadAttributes: 'Spread attributes are not allowed in Hydrate children.',\n      unsafeTypes:\n        'Prop \"{{propName}}\" uses type \"{{typeName}}\" which is derived from db-types.ts. Use safe-db-types.ts instead.',\n    },\n    schema: [\n      {\n        type: 'object',\n        properties: {\n          allowDbTypes: {\n            type: 'array',\n            items: {\n              type: 'string',\n            },\n          },\n        },\n        additionalProperties: false,\n      },\n    ],\n  },\n  defaultOptions: [{}],\n  create(context) {\n    const options = context.options[0] || {};\n    const allowlist = options.allowDbTypes || [];\n    return {\n      JSXElement(node) {\n        const openingElementNameExpression = node.openingElement.name;\n        if (openingElementNameExpression.type !== 'JSXIdentifier') return;\n\n        const elementName = openingElementNameExpression.name;\n        if (elementName !== HYDRATE_COMPONENT_NAME) return;\n\n        const child = extractChild(node.children);\n        if (!child) return;\n\n        // Get the component being rendered\n        const childOpeningElement = child.openingElement;\n        const childElementName = childOpeningElement.name;\n\n        if (childElementName.type !== 'JSXIdentifier') return;\n\n        // Get the component's type to inspect its props\n        const services = ESLintUtils.getParserServices(context);\n        const typeChecker = services.program.getTypeChecker();\n        const tsChildNode = services.esTreeNodeToTSNodeMap.get(childElementName);\n        const componentSymbol = typeChecker.getSymbolAtLocation(tsChildNode);\n\n        if (!componentSymbol) return;\n\n        checkComponentProps({\n          context,\n          typeChecker,\n          componentSymbol,\n          tsComponentNode: tsChildNode,\n          jsxElement: child,\n          reportNode: child,\n          allowlist,\n        });\n      },\n\n      CallExpression(node) {\n        // Check for hydrateHtml(<Component ... />, props?) calls\n        if (node.callee.type !== 'Identifier' || node.callee.name !== HYDRATE_FUNCTION_NAME) return;\n\n        // Should have at least one argument, the first is JSX element.\n        if (node.arguments.length === 0) return;\n\n        const arg = node.arguments[0];\n        if (arg.type !== 'JSXElement') return;\n\n        const jsxElement = arg;\n        const openingElement = jsxElement.openingElement;\n        const elementName = openingElement.name;\n\n        if (elementName.type !== 'JSXIdentifier') return;\n\n        // Get the component's type to inspect its props\n        const services = ESLintUtils.getParserServices(context);\n        const typeChecker = services.program.getTypeChecker();\n        const tsElementNode = services.esTreeNodeToTSNodeMap.get(elementName);\n        const componentSymbol = typeChecker.getSymbolAtLocation(tsElementNode);\n\n        if (!componentSymbol) return;\n\n        checkComponentProps({\n          context,\n          typeChecker,\n          componentSymbol,\n          tsComponentNode: tsElementNode,\n          jsxElement,\n          reportNode: node,\n          allowlist,\n        });\n      },\n    };\n  },\n});\n"]}
+{"version":3,"file":"safe-db-types.d.ts","sourceRoot":"","sources":["../../src/rules/safe-db-types.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;;mBAkfnC,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE","sourcesContent":["import { type TSESTree } from '@typescript-eslint/types';\nimport { ESLintUtils } from '@typescript-eslint/utils';\nimport * as ts from 'typescript';\n\nconst HYDRATE_FUNCTION_NAME = 'hydrateHtml';\nconst HYDRATE_COMPONENT_NAME = 'Hydrate';\n\n/**\n * Check if a variable declaration is a Zod schema that uses schemas from db-types.ts\n * For example: const RubricDataSchema = RubricSchema.extend({...})\n */\nfunction checkZodSchemaForDbTypes(\n  declaration: ts.VariableDeclaration,\n  typeChecker: ts.TypeChecker,\n): string[] {\n  const violations: string[] = [];\n\n  if (!declaration.initializer) return violations;\n\n  // Walk the expression tree to find all identifiers\n  const findIdentifiers = (node: ts.Node): void => {\n    // Check property access expressions like RubricSchema.extend() or InstanceQuestionSchema.shape\n    if (ts.isPropertyAccessExpression(node)) {\n      const objectSymbol = typeChecker.getSymbolAtLocation(node.expression);\n      if (objectSymbol) {\n        const aliasedSymbol =\n          objectSymbol.flags & ts.SymbolFlags.Alias\n            ? typeChecker.getAliasedSymbol(objectSymbol)\n            : objectSymbol;\n        const decls = aliasedSymbol.getDeclarations();\n        if (decls && decls.length > 0) {\n          const sourceFile = decls[0].getSourceFile();\n          if (sourceFile.fileName.endsWith('/db-types.ts')) {\n            violations.push(aliasedSymbol.getName());\n          }\n        }\n      }\n    }\n\n    // Check spread elements in object literals (e.g., ...SomeSchema.shape)\n    if (ts.isSpreadAssignment(node)) {\n      // The expression being spread (e.g., SomeSchema.shape)\n      const spreadExpr = node.expression;\n\n      // Check if it's a property access (e.g., accessing .shape)\n      if (ts.isPropertyAccessExpression(spreadExpr)) {\n        const objectSymbol = typeChecker.getSymbolAtLocation(spreadExpr.expression);\n        if (objectSymbol) {\n          const aliasedSymbol =\n            objectSymbol.flags & ts.SymbolFlags.Alias\n              ? typeChecker.getAliasedSymbol(objectSymbol)\n              : objectSymbol;\n          const decls = aliasedSymbol.getDeclarations();\n          if (decls && decls.length > 0) {\n            const sourceFile = decls[0].getSourceFile();\n            if (sourceFile.fileName.endsWith('/db-types.ts')) {\n              violations.push(aliasedSymbol.getName());\n            } else {\n              // The schema is defined locally, check if IT uses db-types\n              for (const decl of decls) {\n                if (ts.isVariableDeclaration(decl)) {\n                  // Recursively check the local schema\n                  const nestedViolations = checkZodSchemaForDbTypes(decl, typeChecker);\n                  violations.push(...nestedViolations);\n                }\n              }\n            }\n          }\n        }\n      }\n      // Also check if the spread is a direct identifier (e.g., ...someObject)\n      else if (ts.isIdentifier(spreadExpr)) {\n        const spreadSymbol = typeChecker.getSymbolAtLocation(spreadExpr);\n        if (spreadSymbol) {\n          const aliasedSymbol =\n            spreadSymbol.flags & ts.SymbolFlags.Alias\n              ? typeChecker.getAliasedSymbol(spreadSymbol)\n              : spreadSymbol;\n          const decls = aliasedSymbol.getDeclarations();\n          if (decls && decls.length > 0) {\n            const sourceFile = decls[0].getSourceFile();\n            if (sourceFile.fileName.endsWith('/db-types.ts')) {\n              violations.push(aliasedSymbol.getName());\n            }\n          }\n        }\n      }\n    }\n\n    // Check call expressions for arguments\n    if (ts.isCallExpression(node)) {\n      for (const arg of node.arguments) {\n        // Check if argument is an identifier (e.g., RubricItemSchema)\n        if (ts.isIdentifier(arg)) {\n          const argSymbol = typeChecker.getSymbolAtLocation(arg);\n          if (argSymbol) {\n            const aliasedSymbol =\n              argSymbol.flags & ts.SymbolFlags.Alias\n                ? typeChecker.getAliasedSymbol(argSymbol)\n                : argSymbol;\n            const decls = aliasedSymbol.getDeclarations();\n            if (decls && decls.length > 0) {\n              const sourceFile = decls[0].getSourceFile();\n              if (sourceFile.fileName.endsWith('/db-types.ts')) {\n                violations.push(aliasedSymbol.getName());\n              }\n            }\n          }\n        }\n      }\n    }\n\n    // Check object literal property assignments (e.g., { rubric: RubricSchema })\n    if (ts.isPropertyAssignment(node) && ts.isIdentifier(node.initializer)) {\n      const identifier = node.initializer;\n      const symbol = typeChecker.getSymbolAtLocation(identifier);\n      if (symbol) {\n        const aliasedSymbol =\n          symbol.flags & ts.SymbolFlags.Alias ? typeChecker.getAliasedSymbol(symbol) : symbol;\n        const decls = aliasedSymbol.getDeclarations();\n        if (decls && decls.length > 0) {\n          const sourceFile = decls[0].getSourceFile();\n          if (sourceFile.fileName.endsWith('/db-types.ts')) {\n            violations.push(aliasedSymbol.getName());\n          }\n        }\n      }\n    }\n\n    ts.forEachChild(node, findIdentifiers);\n  };\n\n  findIdentifiers(declaration.initializer);\n  return violations;\n}\n\n/**\n * Check if a type node is z.infer<typeof SchemaName> and if SchemaName uses db-types\n * Returns the names of db-types that the schema depends on\n */\nfunction checkForZodInferPattern(typeNode: ts.TypeNode, typeChecker: ts.TypeChecker): string[] {\n  // Check if this is a type reference with type arguments\n  if (!ts.isTypeReferenceNode(typeNode)) return [];\n\n  // Check if the type reference is named (e.g., \"infer\" from z.infer)\n  const typeName = typeNode.typeName;\n  if (!ts.isQualifiedName(typeName)) return [];\n\n  // Check if it's z.infer or similar pattern\n  // The pattern is: z.infer<typeof SchemaName>\n  const typeArgs = typeNode.typeArguments;\n  if (!typeArgs || typeArgs.length !== 1) return [];\n\n  const typeArg = typeArgs[0];\n\n  // Check if the type argument is a typeof expression\n  if (!ts.isTypeQueryNode(typeArg)) return [];\n\n  // Get the schema name from typeof X\n  const exprName = typeArg.exprName;\n  if (!ts.isIdentifier(exprName)) return [];\n\n  // Now find the schema variable declaration\n  const schemaSymbol = typeChecker.getSymbolAtLocation(exprName);\n  if (!schemaSymbol) return [];\n\n  // Check if this is an imported symbol (alias) - follow it to the original\n  const symbolToCheck =\n    schemaSymbol.flags & ts.SymbolFlags.Alias\n      ? typeChecker.getAliasedSymbol(schemaSymbol)\n      : schemaSymbol;\n\n  const schemaDecls = symbolToCheck.getDeclarations();\n  if (!schemaDecls || schemaDecls.length === 0) return [];\n\n  // Check if it's a variable declaration\n  for (const decl of schemaDecls) {\n    if (ts.isVariableDeclaration(decl)) {\n      // If the schema is defined in safe-db-types.ts, it's safe by definition\n      const sourceFile = decl.getSourceFile();\n      if (sourceFile.fileName.endsWith('/safe-db-types.ts')) {\n        return [];\n      }\n\n      // Use our existing helper to check if the schema uses db-types\n      return checkZodSchemaForDbTypes(decl, typeChecker);\n    }\n  }\n\n  return [];\n}\n\nfunction extractChild(children: TSESTree.JSXChild[]): TSESTree.JSXElement | null {\n  const nonWhitespaceChildren = children.filter((child) => {\n    if (child.type === 'JSXText') {\n      return child.value.trim().length > 0;\n    }\n    return true;\n  });\n\n  if (nonWhitespaceChildren.length !== 1 || nonWhitespaceChildren[0].type !== 'JSXElement') {\n    return null;\n  }\n\n  return nonWhitespaceChildren[0];\n}\n\n/**\n * Check if a TypeScript type node references a type from db-types.ts\n * This checks the actual source code type annotation, not the resolved type.\n * Follows type aliases (imports) to their original declaration.\n * Returns all unsafe type names found.\n */\nfunction checkTypeNodeForDbTypes(\n  typeNode: ts.TypeNode,\n  typeChecker: ts.TypeChecker,\n  visited = new Set<ts.TypeNode>(),\n): string[] {\n  if (visited.has(typeNode)) return [];\n  visited.add(typeNode);\n\n  const violations: string[] = [];\n\n  // Check type references (e.g., User, Course, AuthnProvider)\n  if (ts.isTypeReferenceNode(typeNode)) {\n    const typeName = typeNode.typeName;\n    const symbol = typeChecker.getSymbolAtLocation(typeName);\n\n    if (symbol) {\n      // Check if this is an imported symbol (alias) - follow it to the original\n      const symbolToCheck =\n        symbol.flags & ts.SymbolFlags.Alias ? typeChecker.getAliasedSymbol(symbol) : symbol;\n\n      const declarations = symbolToCheck.getDeclarations();\n      if (declarations && declarations.length > 0) {\n        for (const decl of declarations) {\n          const sourceFile = decl.getSourceFile();\n          if (sourceFile.fileName.endsWith('/db-types.ts')) {\n            // Found a type from db-types.ts!\n            violations.push(symbolToCheck.getName());\n          } else {\n            // If it's a type alias or interface defined locally, check its properties\n            if (ts.isTypeAliasDeclaration(decl) && decl.type) {\n              // Special case: Check if this is z.infer<typeof XxxSchema>\n              const zodSchemaViolations = checkForZodInferPattern(decl.type, typeChecker);\n              violations.push(...zodSchemaViolations);\n\n              // Also check the type itself\n              const nestedViolations = checkTypeNodeForDbTypes(decl.type, typeChecker, visited);\n              violations.push(...nestedViolations);\n            } else if (ts.isInterfaceDeclaration(decl)) {\n              // Check interface members\n              for (const member of decl.members) {\n                if (ts.isPropertySignature(member) && member.type) {\n                  const nestedViolations = checkTypeNodeForDbTypes(\n                    member.type,\n                    typeChecker,\n                    visited,\n                  );\n                  violations.push(...nestedViolations);\n                }\n              }\n            }\n          }\n        }\n      }\n    }\n\n    // Check type arguments (e.g., Array<User>, Promise<Course>)\n    if (typeNode.typeArguments) {\n      for (const typeArg of typeNode.typeArguments) {\n        const nestedViolations = checkTypeNodeForDbTypes(typeArg, typeChecker, visited);\n        violations.push(...nestedViolations);\n      }\n    }\n  }\n\n  // Check array types (e.g., User[])\n  if (ts.isArrayTypeNode(typeNode)) {\n    const nestedViolations = checkTypeNodeForDbTypes(typeNode.elementType, typeChecker, visited);\n    violations.push(...nestedViolations);\n  }\n\n  // Check union types (e.g., User | null)\n  if (ts.isUnionTypeNode(typeNode)) {\n    for (const type of typeNode.types) {\n      const nestedViolations = checkTypeNodeForDbTypes(type, typeChecker, visited);\n      violations.push(...nestedViolations);\n    }\n  }\n\n  // Check intersection types (e.g., User & { extra: string })\n  if (ts.isIntersectionTypeNode(typeNode)) {\n    for (const type of typeNode.types) {\n      const nestedViolations = checkTypeNodeForDbTypes(type, typeChecker, visited);\n      violations.push(...nestedViolations);\n    }\n  }\n\n  // Check object type literals and their properties\n  if (ts.isTypeLiteralNode(typeNode)) {\n    for (const member of typeNode.members) {\n      if (ts.isPropertySignature(member) && member.type) {\n        const nestedViolations = checkTypeNodeForDbTypes(member.type, typeChecker, visited);\n        violations.push(...nestedViolations);\n      }\n    }\n  }\n\n  // Check indexed access types (e.g., User['name'])\n  // These are safe! We're only extracting a specific property, not passing the whole object.\n  // So we DON'T recurse into the object type for indexed access.\n  if (ts.isIndexedAccessTypeNode(typeNode)) {\n    // Do not check - indexed access is safe\n  }\n\n  return violations;\n}\n\n/**\n * Check if a type name is in the allowlist of safe types\n */\nfunction isTypeInAllowlist(typeName: string, allowlist: (string | RegExp)[]): boolean {\n  return allowlist.some((pattern) => {\n    if (typeof pattern === 'string') {\n      return typeName === pattern;\n    }\n    return pattern.test(typeName);\n  });\n}\n\n/**\n * Check the props of a component for unsafe types from db-types.ts\n */\nfunction checkComponentProps({\n  context,\n  typeChecker,\n  componentSymbol,\n  tsComponentNode,\n  jsxElement,\n  reportNode,\n  allowlist,\n}: {\n  context: ReturnType<typeof ESLintUtils.RuleCreator.withoutDocs>['create'] extends (\n    context: infer C,\n  ) => any\n    ? C\n    : never;\n  typeChecker: ts.TypeChecker;\n  componentSymbol: ts.Symbol;\n  tsComponentNode: ts.Node;\n  jsxElement: TSESTree.JSXElement;\n  reportNode: TSESTree.Node;\n  allowlist: (string | RegExp)[];\n}): void {\n  const childOpeningElement = jsxElement.openingElement;\n\n  // Get the component's type (function or class component)\n  const componentType = typeChecker.getTypeOfSymbolAtLocation(componentSymbol, tsComponentNode);\n  const signatures = componentType.getCallSignatures();\n\n  if (signatures.length === 0) return;\n\n  // Get the first parameter (props) of the component function\n  const propsParam = signatures[0].getParameters()[0];\n  if (!propsParam) return;\n\n  const propsDeclaration = propsParam.valueDeclaration;\n\n  if (!propsDeclaration || !ts.isParameter(propsDeclaration)) return;\n\n  // Get the type annotation node from the props parameter\n  const propsTypeNode = propsDeclaration.type;\n  if (!propsTypeNode) return;\n\n  // Check each property in the props type\n  if (ts.isTypeLiteralNode(propsTypeNode)) {\n    // Inline props object: { foo: string; bar: number }\n    for (const member of propsTypeNode.members) {\n      if (ts.isPropertySignature(member) && member.type && member.name) {\n        if (!ts.isIdentifier(member.name)) continue;\n\n        const propName = member.name.text;\n        const violations = checkTypeNodeForDbTypes(member.type, typeChecker);\n\n        if (violations.length > 0) {\n          // Find the JSX attribute for this prop\n          const attribute = childOpeningElement.attributes.find(\n            (attr) =>\n              attr.type === 'JSXAttribute' &&\n              attr.name.type === 'JSXIdentifier' &&\n              attr.name.name === propName,\n          );\n\n          for (const typeName of violations) {\n            if (isTypeInAllowlist(typeName, allowlist)) continue;\n\n            context.report({\n              node: attribute || reportNode,\n              messageId: 'unsafeTypes',\n              data: { propName, typeName },\n            });\n          }\n        }\n      }\n    }\n  } else if (ts.isTypeReferenceNode(propsTypeNode)) {\n    // Props is a type reference (e.g., interface or type alias)\n    const symbol = typeChecker.getSymbolAtLocation(propsTypeNode.typeName);\n    if (symbol) {\n      const resolvedSymbol =\n        symbol.flags & ts.SymbolFlags.Alias ? typeChecker.getAliasedSymbol(symbol) : symbol;\n      const declarations = resolvedSymbol.getDeclarations();\n\n      if (declarations && declarations.length > 0) {\n        for (const decl of declarations) {\n          if (ts.isInterfaceDeclaration(decl) || ts.isTypeLiteralNode(decl)) {\n            const members = ts.isInterfaceDeclaration(decl) ? decl.members : decl.members;\n\n            for (const member of members) {\n              if (ts.isPropertySignature(member) && member.type && member.name) {\n                if (!ts.isIdentifier(member.name)) continue;\n\n                const propName = member.name.text;\n                const violations = checkTypeNodeForDbTypes(member.type, typeChecker);\n\n                if (violations.length > 0) {\n                  // Find the JSX attribute for this prop\n                  const attribute = childOpeningElement.attributes.find(\n                    (attr) =>\n                      attr.type === 'JSXAttribute' &&\n                      attr.name.type === 'JSXIdentifier' &&\n                      attr.name.name === propName,\n                  );\n\n                  for (const typeName of violations) {\n                    if (isTypeInAllowlist(typeName, allowlist)) continue;\n\n                    context.report({\n                      node: attribute || reportNode,\n                      messageId: 'unsafeTypes',\n                      data: { propName, typeName },\n                    });\n                  }\n                }\n              }\n            }\n          } else if (ts.isTypeAliasDeclaration(decl) && decl.type) {\n            // Type alias might be an inline object type\n            if (ts.isTypeLiteralNode(decl.type)) {\n              for (const member of decl.type.members) {\n                if (ts.isPropertySignature(member) && member.type && member.name) {\n                  if (!ts.isIdentifier(member.name)) continue;\n\n                  const propName = member.name.text;\n                  const violations = checkTypeNodeForDbTypes(member.type, typeChecker);\n\n                  if (violations.length > 0) {\n                    // Find the JSX attribute for this prop\n                    const attribute = childOpeningElement.attributes.find(\n                      (attr) =>\n                        attr.type === 'JSXAttribute' &&\n                        attr.name.type === 'JSXIdentifier' &&\n                        attr.name.name === propName,\n                    );\n\n                    for (const typeName of violations) {\n                      if (isTypeInAllowlist(typeName, allowlist)) continue;\n\n                      context.report({\n                        node: attribute || reportNode,\n                        messageId: 'unsafeTypes',\n                        data: { propName, typeName },\n                      });\n                    }\n                  }\n                }\n              }\n            }\n          }\n        }\n      }\n    }\n  }\n\n  // Check for spread attributes\n  const attributes = childOpeningElement.attributes;\n  for (const attr of attributes) {\n    if (attr.type === 'JSXSpreadAttribute') {\n      context.report({\n        node: reportNode,\n        messageId: 'spreadAttributes',\n      });\n      continue;\n    }\n  }\n}\n\nexport default ESLintUtils.RuleCreator.withoutDocs<\n  [{ allowDbTypes?: (string | RegExp)[] }?],\n  'spreadAttributes' | 'unsafeTypes'\n>({\n  meta: {\n    type: 'problem',\n    messages: {\n      spreadAttributes: 'Spread attributes are not allowed in Hydrate children.',\n      unsafeTypes:\n        'Prop \"{{propName}}\" uses type \"{{typeName}}\" which is derived from db-types.ts. Use safe-db-types.ts instead.',\n    },\n    schema: [\n      {\n        type: 'object',\n        properties: {\n          allowDbTypes: {\n            type: 'array',\n            items: {\n              type: 'string',\n            },\n          },\n        },\n        additionalProperties: false,\n      },\n    ],\n  },\n  defaultOptions: [{}],\n  create(context) {\n    const options = context.options[0] || {};\n    const allowlist = options.allowDbTypes || [];\n    return {\n      JSXElement(node) {\n        const openingElementNameExpression = node.openingElement.name;\n        if (openingElementNameExpression.type !== 'JSXIdentifier') return;\n\n        const elementName = openingElementNameExpression.name;\n        if (elementName !== HYDRATE_COMPONENT_NAME) return;\n\n        const child = extractChild(node.children);\n        if (!child) return;\n\n        // Get the component being rendered\n        const childOpeningElement = child.openingElement;\n        const childElementName = childOpeningElement.name;\n\n        if (childElementName.type !== 'JSXIdentifier') return;\n\n        // Get the component's type to inspect its props\n        const services = ESLintUtils.getParserServices(context);\n        const typeChecker = services.program.getTypeChecker();\n        const tsChildNode = services.esTreeNodeToTSNodeMap.get(childElementName);\n        const componentSymbol = typeChecker.getSymbolAtLocation(tsChildNode);\n\n        if (!componentSymbol) return;\n\n        checkComponentProps({\n          context,\n          typeChecker,\n          componentSymbol,\n          tsComponentNode: tsChildNode,\n          jsxElement: child,\n          reportNode: child,\n          allowlist,\n        });\n      },\n\n      CallExpression(node) {\n        // Check for hydrateHtml(<Component ... />, props?) calls\n        if (node.callee.type !== 'Identifier' || node.callee.name !== HYDRATE_FUNCTION_NAME) return;\n\n        // Should have at least one argument, the first is JSX element.\n        if (node.arguments.length === 0) return;\n\n        const arg = node.arguments[0];\n        if (arg.type !== 'JSXElement') return;\n\n        const jsxElement = arg;\n        const openingElement = jsxElement.openingElement;\n        const elementName = openingElement.name;\n\n        if (elementName.type !== 'JSXIdentifier') return;\n\n        // Get the component's type to inspect its props\n        const services = ESLintUtils.getParserServices(context);\n        const typeChecker = services.program.getTypeChecker();\n        const tsElementNode = services.esTreeNodeToTSNodeMap.get(elementName);\n        const componentSymbol = typeChecker.getSymbolAtLocation(tsElementNode);\n\n        if (!componentSymbol) return;\n\n        checkComponentProps({\n          context,\n          typeChecker,\n          componentSymbol,\n          tsComponentNode: tsElementNode,\n          jsxElement,\n          reportNode: node,\n          allowlist,\n        });\n      },\n    };\n  },\n});\n"]}

package/dist/rules/safe-db-types.js

@@ -1,40 +1,6 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-const utils_1 = require("@typescript-eslint/utils");
-const ts = __importStar(require("typescript"));
+import {} from '@typescript-eslint/types';
+import { ESLintUtils } from '@typescript-eslint/utils';
+import * as ts from 'typescript';
 const HYDRATE_FUNCTION_NAME = 'hydrateHtml';
 const HYDRATE_COMPONENT_NAME = 'Hydrate';
 /**
@@ -443,7 +409,7 @@ function checkComponentProps({ context, typeChecker, componentSymbol, tsComponen
         }
     }
 }
-exports.default = utils_1.ESLintUtils.RuleCreator.withoutDocs({
+export default ESLintUtils.RuleCreator.withoutDocs({
     meta: {
         type: 'problem',
         messages: {
@@ -486,7 +452,7 @@ exports.default = utils_1.ESLintUtils.RuleCreator.withoutDocs({
                 if (childElementName.type !== 'JSXIdentifier')
                     return;
                 // Get the component's type to inspect its props
-                const services = utils_1.ESLintUtils.getParserServices(context);
+                const services = ESLintUtils.getParserServices(context);
                 const typeChecker = services.program.getTypeChecker();
                 const tsChildNode = services.esTreeNodeToTSNodeMap.get(childElementName);
                 const componentSymbol = typeChecker.getSymbolAtLocation(tsChildNode);
@@ -518,7 +484,7 @@ exports.default = utils_1.ESLintUtils.RuleCreator.withoutDocs({
                 if (elementName.type !== 'JSXIdentifier')
                     return;
                 // Get the component's type to inspect its props
-                const services = utils_1.ESLintUtils.getParserServices(context);
+                const services = ESLintUtils.getParserServices(context);
                 const typeChecker = services.program.getTypeChecker();
                 const tsElementNode = services.esTreeNodeToTSNodeMap.get(elementName);
                 const componentSymbol = typeChecker.getSymbolAtLocation(tsElementNode);