@prairielearn/eslint-plugin 4.1.0 → 4.2.0

package/dist/tests/require-trpc-permission-middleware.test.js

@@ -0,0 +1,106 @@
+import { RuleTester } from '@typescript-eslint/rule-tester';
+import { afterAll, describe, it } from 'vitest';
+import rule from '../rules/require-trpc-permission-middleware.js';
+RuleTester.afterAll = afterAll;
+RuleTester.describe = describe;
+RuleTester.it = it;
+const ruleTester = new RuleTester();
+ruleTester.run('require-trpc-permission-middleware', rule, {
+    valid: [
+        {
+            code: 'const list = t.procedure.use(requireCoursePermissionEdit).query(async () => {});',
+        },
+        {
+            code: 'const m = t.procedure.use(requireCoursePermissionPreview).mutation(async () => {});',
+        },
+        {
+            code: `const m = t.procedure
+        .use(requireEnhancedAccessControl)
+        .use(requireCourseInstancePermissionView)
+        .query(async () => {});`,
+        },
+        {
+            code: 'const m = t.procedure.use(requireAdministrator).mutation(async () => {});',
+        },
+        {
+            code: `const m = t.procedure
+        .use(requireCourseInstancePermissionEdit)
+        .input(z.object({}))
+        .mutation(async () => {});`,
+        },
+        {
+            code: 'const list = t.procedure.use(requireCoursePermissionOwn).query(async () => {});',
+        },
+        // Not a t.procedure chain — should be ignored
+        {
+            code: 'const fn = somethingElse.query(async () => {});',
+        },
+        {
+            code: 'const fn = otherRouter.procedure.query(async () => {});',
+        },
+        // Intermediate procedure-base variable: permission middleware on the base
+        {
+            code: `
+        const protectedProcedure = t.procedure.use(requireCoursePermissionOwn);
+        const m = protectedProcedure.query(async () => {});
+      `,
+        },
+        // Intermediate procedure-base variable: permission added downstream
+        {
+            code: `
+        const featureProcedure = t.procedure.use(requireAiGradingFeature);
+        const m = featureProcedure.use(requireAdministrator).mutation(async () => {});
+      `,
+        },
+        // Imported procedure base — we can't follow across files, so don't fire
+        {
+            code: `
+        import { protectedProcedure } from './foo.js';
+        const m = protectedProcedure.query(async () => {});
+      `,
+            languageOptions: { parserOptions: { sourceType: 'module' } },
+        },
+    ],
+    invalid: [
+        {
+            code: 'const list = t.procedure.query(async () => {});',
+            errors: [{ messageId: 'missingPermissionMiddleware' }],
+        },
+        {
+            code: 'const m = t.procedure.input(z.object({})).mutation(async () => {});',
+            errors: [{ messageId: 'missingPermissionMiddleware' }],
+        },
+        // Feature gate alone is not a permission gate
+        {
+            code: 'const m = t.procedure.use(requireEnhancedAccessControl).mutation(async () => {});',
+            errors: [{ messageId: 'missingPermissionMiddleware' }],
+        },
+        {
+            code: 'const m = t.procedure.use(requireAiGradingFeature).mutation(async () => {});',
+            errors: [{ messageId: 'missingPermissionMiddleware' }],
+        },
+        {
+            code: `const m = t.procedure
+        .input(z.object({}))
+        .output(z.object({}))
+        .subscription(async () => {});`,
+            errors: [{ messageId: 'missingPermissionMiddleware' }],
+        },
+        // Intermediate procedure-base variable with only a feature gate is still a miss
+        {
+            code: `
+        const featureProcedure = t.procedure.use(requireAiGradingFeature);
+        const m = featureProcedure.query(async () => {});
+      `,
+            errors: [{ messageId: 'missingPermissionMiddleware' }],
+        },
+        {
+            code: `
+        const featureProcedure = t.procedure.use(requireAiGradingFeature);
+        const m = featureProcedure.input(z.object({})).mutation(async () => {});
+      `,
+            errors: [{ messageId: 'missingPermissionMiddleware' }],
+        },
+    ],
+});
+//# sourceMappingURL=require-trpc-permission-middleware.test.js.map

package/dist/tests/require-trpc-permission-middleware.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-trpc-permission-middleware.test.js","sourceRoot":"","sources":["../../src/tests/require-trpc-permission-middleware.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAEhD,OAAO,IAAI,MAAM,gDAAgD,CAAC;AAElE,UAAU,CAAC,QAAQ,GAAG,QAAQ,CAAC;AAC/B,UAAU,CAAC,QAAQ,GAAG,QAAQ,CAAC;AAC/B,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC;AAEnB,MAAM,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC;AAEpC,UAAU,CAAC,GAAG,CAAC,oCAAoC,EAAE,IAAI,EAAE;IACzD,KAAK,EAAE;QACL;YACE,IAAI,EAAE,kFAAkF;SACzF;QACD;YACE,IAAI,EAAE,qFAAqF;SAC5F;QACD;YACE,IAAI,EAAE;;;gCAGoB;SAC3B;QACD;YACE,IAAI,EAAE,2EAA2E;SAClF;QACD;YACE,IAAI,EAAE;;;mCAGuB;SAC9B;QACD;YACE,IAAI,EAAE,iFAAiF;SACxF;QACD,8CAA8C;QAC9C;YACE,IAAI,EAAE,iDAAiD;SACxD;QACD;YACE,IAAI,EAAE,yDAAyD;SAChE;QACD,0EAA0E;QAC1E;YACE,IAAI,EAAE;;;OAGL;SACF;QACD,oEAAoE;QACpE;YACE,IAAI,EAAE;;;OAGL;SACF;QACD,wEAAwE;QACxE;YACE,IAAI,EAAE;;;OAGL;YACD,eAAe,EAAE,EAAE,aAAa,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE;SAC7D;KACF;IACD,OAAO,EAAE;QACP;YACE,IAAI,EAAE,iDAAiD;YACvD,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,6BAA6B,EAAE,CAAC;SACvD;QACD;YACE,IAAI,EAAE,qEAAqE;YAC3E,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,6BAA6B,EAAE,CAAC;SACvD;QACD,8CAA8C;QAC9C;YACE,IAAI,EAAE,mFAAmF;YACzF,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,6BAA6B,EAAE,CAAC;SACvD;QACD;YACE,IAAI,EAAE,8EAA8E;YACpF,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,6BAA6B,EAAE,CAAC;SACvD;QACD;YACE,IAAI,EAAE;;;uCAG2B;YACjC,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,6BAA6B,EAAE,CAAC;SACvD;QACD,gFAAgF;QAChF;YACE,IAAI,EAAE;;;OAGL;YACD,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,6BAA6B,EAAE,CAAC;SACvD;QACD;YACE,IAAI,EAAE;;;OAGL;YACD,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,6BAA6B,EAAE,CAAC;SACvD;KACF;CACF,CAAC,CAAC","sourcesContent":["import { RuleTester } from '@typescript-eslint/rule-tester';\nimport { afterAll, describe, it } from 'vitest';\n\nimport rule from '../rules/require-trpc-permission-middleware.js';\n\nRuleTester.afterAll = afterAll;\nRuleTester.describe = describe;\nRuleTester.it = it;\n\nconst ruleTester = new RuleTester();\n\nruleTester.run('require-trpc-permission-middleware', rule, {\n  valid: [\n    {\n      code: 'const list = t.procedure.use(requireCoursePermissionEdit).query(async () => {});',\n    },\n    {\n      code: 'const m = t.procedure.use(requireCoursePermissionPreview).mutation(async () => {});',\n    },\n    {\n      code: `const m = t.procedure\n        .use(requireEnhancedAccessControl)\n        .use(requireCourseInstancePermissionView)\n        .query(async () => {});`,\n    },\n    {\n      code: 'const m = t.procedure.use(requireAdministrator).mutation(async () => {});',\n    },\n    {\n      code: `const m = t.procedure\n        .use(requireCourseInstancePermissionEdit)\n        .input(z.object({}))\n        .mutation(async () => {});`,\n    },\n    {\n      code: 'const list = t.procedure.use(requireCoursePermissionOwn).query(async () => {});',\n    },\n    // Not a t.procedure chain — should be ignored\n    {\n      code: 'const fn = somethingElse.query(async () => {});',\n    },\n    {\n      code: 'const fn = otherRouter.procedure.query(async () => {});',\n    },\n    // Intermediate procedure-base variable: permission middleware on the base\n    {\n      code: `\n        const protectedProcedure = t.procedure.use(requireCoursePermissionOwn);\n        const m = protectedProcedure.query(async () => {});\n      `,\n    },\n    // Intermediate procedure-base variable: permission added downstream\n    {\n      code: `\n        const featureProcedure = t.procedure.use(requireAiGradingFeature);\n        const m = featureProcedure.use(requireAdministrator).mutation(async () => {});\n      `,\n    },\n    // Imported procedure base — we can't follow across files, so don't fire\n    {\n      code: `\n        import { protectedProcedure } from './foo.js';\n        const m = protectedProcedure.query(async () => {});\n      `,\n      languageOptions: { parserOptions: { sourceType: 'module' } },\n    },\n  ],\n  invalid: [\n    {\n      code: 'const list = t.procedure.query(async () => {});',\n      errors: [{ messageId: 'missingPermissionMiddleware' }],\n    },\n    {\n      code: 'const m = t.procedure.input(z.object({})).mutation(async () => {});',\n      errors: [{ messageId: 'missingPermissionMiddleware' }],\n    },\n    // Feature gate alone is not a permission gate\n    {\n      code: 'const m = t.procedure.use(requireEnhancedAccessControl).mutation(async () => {});',\n      errors: [{ messageId: 'missingPermissionMiddleware' }],\n    },\n    {\n      code: 'const m = t.procedure.use(requireAiGradingFeature).mutation(async () => {});',\n      errors: [{ messageId: 'missingPermissionMiddleware' }],\n    },\n    {\n      code: `const m = t.procedure\n        .input(z.object({}))\n        .output(z.object({}))\n        .subscription(async () => {});`,\n      errors: [{ messageId: 'missingPermissionMiddleware' }],\n    },\n    // Intermediate procedure-base variable with only a feature gate is still a miss\n    {\n      code: `\n        const featureProcedure = t.procedure.use(requireAiGradingFeature);\n        const m = featureProcedure.query(async () => {});\n      `,\n      errors: [{ messageId: 'missingPermissionMiddleware' }],\n    },\n    {\n      code: `\n        const featureProcedure = t.procedure.use(requireAiGradingFeature);\n        const m = featureProcedure.input(z.object({})).mutation(async () => {});\n      `,\n      errors: [{ messageId: 'missingPermissionMiddleware' }],\n    },\n  ],\n});\n"]}

package/dist/utils.js

@@ -1,6 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.getAwsClientNamesFromImportDeclaration = getAwsClientNamesFromImportDeclaration;
 /**
  * Determines if the given identifier name corresponds to a client from the
  * given package.
@@ -29,7 +26,7 @@ function isIdentifierClient(identifierName, packageName) {
  *
  * then this function will return a set containing the strings "S3" and "S3Client".
  */
-function getAwsClientNamesFromImportDeclaration(node) {
+export function getAwsClientNamesFromImportDeclaration(node) {
     const clientNames = new Set();
     const importSource = node.source.value;
     if (importSource.startsWith('@aws-sdk/client-')) {

package/dist/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,SAAS,kBAAkB,CAAC,cAAsB,EAAE,WAAmB;IACrE,+DAA+D;IAC/D,IAAI,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8EAA8E;IAC9E,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACvE,IAAI,cAAc,CAAC,WAAW,EAAE,KAAK,iBAAiB,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,gDAAuD,IAAS;IAC9D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IAEtC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;IACvC,IAAI,YAAY,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,SAAc,EAAE,EAAE;YACzC,IAAI,SAAS,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBACzC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC9C,IAAI,kBAAkB,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE,CAAC;oBACpD,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBACjC,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["/**\n * Determines if the given identifier name corresponds to a client from the\n * given package.\n */\nfunction isIdentifierClient(identifierName: string, packageName: string): boolean {\n  // If the identifier ends with \"Client\", include it in the set.\n  if (identifierName.endsWith('Client')) {\n    return true;\n  }\n\n  // If the identifier matches the package name directly, include it in the set.\n  const clientName = packageName.replace('@aws-sdk/client-', '');\n  const packageIdentifier = clientName.replaceAll('-', '').toLowerCase();\n  if (identifierName.toLowerCase() === packageIdentifier) {\n    return true;\n  }\n\n  return false;\n}\n\n/**\n * Retrieves the names of AWS clients specified by the given import declaration.\n *\n * For instance, if the import declaration is:\n *\n * ```ts\n * import { S3, S3Client } from '@aws-sdk/client-s3';\n * ```\n *\n * then this function will return a set containing the strings \"S3\" and \"S3Client\".\n */\nexport function getAwsClientNamesFromImportDeclaration(node: any) {\n  const clientNames = new Set<string>();\n\n  const importSource = node.source.value;\n  if (importSource.startsWith('@aws-sdk/client-')) {\n    node.specifiers.forEach((specifier: any) => {\n      if (specifier.type === 'ImportSpecifier') {\n        const specifierName = specifier.imported.name;\n        if (isIdentifierClient(specifierName, importSource)) {\n          clientNames.add(specifierName);\n        }\n      }\n    });\n  }\n\n  return clientNames;\n}\n"]}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,SAAS,kBAAkB,CAAC,cAAsB,EAAE,WAAmB;IACrE,+DAA+D;IAC/D,IAAI,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8EAA8E;IAC9E,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACvE,IAAI,cAAc,CAAC,WAAW,EAAE,KAAK,iBAAiB,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sCAAsC,CAAC,IAAS;IAC9D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IAEtC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;IACvC,IAAI,YAAY,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,SAAc,EAAE,EAAE;YACzC,IAAI,SAAS,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBACzC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC9C,IAAI,kBAAkB,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE,CAAC;oBACpD,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBACjC,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["/**\n * Determines if the given identifier name corresponds to a client from the\n * given package.\n */\nfunction isIdentifierClient(identifierName: string, packageName: string): boolean {\n  // If the identifier ends with \"Client\", include it in the set.\n  if (identifierName.endsWith('Client')) {\n    return true;\n  }\n\n  // If the identifier matches the package name directly, include it in the set.\n  const clientName = packageName.replace('@aws-sdk/client-', '');\n  const packageIdentifier = clientName.replaceAll('-', '').toLowerCase();\n  if (identifierName.toLowerCase() === packageIdentifier) {\n    return true;\n  }\n\n  return false;\n}\n\n/**\n * Retrieves the names of AWS clients specified by the given import declaration.\n *\n * For instance, if the import declaration is:\n *\n * ```ts\n * import { S3, S3Client } from '@aws-sdk/client-s3';\n * ```\n *\n * then this function will return a set containing the strings \"S3\" and \"S3Client\".\n */\nexport function getAwsClientNamesFromImportDeclaration(node: any) {\n  const clientNames = new Set<string>();\n\n  const importSource = node.source.value;\n  if (importSource.startsWith('@aws-sdk/client-')) {\n    node.specifiers.forEach((specifier: any) => {\n      if (specifier.type === 'ImportSpecifier') {\n        const specifierName = specifier.imported.name;\n        if (isIdentifierClient(specifierName, importSource)) {\n          clientNames.add(specifierName);\n        }\n      }\n    });\n  }\n\n  return clientNames;\n}\n"]}

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@prairielearn/eslint-plugin",
-  "version": "4.1.0",
+  "version": "4.2.0",
+  "type": "module",
   "repository": {
     "type": "git",
     "url": "https://github.com/PrairieLearn/PrairieLearn.git",
@@ -19,17 +20,17 @@
     "eslint": "^10.0.0"
   },
   "dependencies": {
-    "@typescript-eslint/utils": "^8.58.0",
-    "typescript": "^5.9.3"
+    "@typescript-eslint/utils": "^8.59.2",
+    "typescript": "^6.0.3"
   },
   "devDependencies": {
-    "@prairielearn/tsconfig": "^2.0.0",
+    "@prairielearn/tsconfig": "^2.1.0",
     "@types/node": "^24.12.2",
-    "@typescript-eslint/rule-tester": "^8.58.0",
-    "@typescript-eslint/types": "^8.58.0",
-    "@typescript/native-preview": "^7.0.0-dev.20260305.1",
-    "@vitest/coverage-v8": "^4.1.2",
+    "@typescript-eslint/rule-tester": "^8.59.2",
+    "@typescript-eslint/types": "^8.59.2",
+    "@typescript/native-preview": "beta",
+    "@vitest/coverage-v8": "^4.1.5",
     "tsx": "^4.21.0",
-    "vitest": "^4.1.2"
+    "vitest": "^4.1.5"
   }
 }

package/src/index.ts

@@ -4,14 +4,18 @@ import jsxNoDollarInterpolation from './rules/jsx-no-dollar-interpolation.js';
 import noCurrentTargetInCallback from './rules/no-current-target-in-callback.js';
 import noHydrateResLocals from './rules/no-hydrate-reslocals.js';
 import noUnusedSqlBlocks from './rules/no-unused-sql-blocks.js';
+import requireTrpcPermissionMiddleware from './rules/require-trpc-permission-middleware.js';
 import safeDbTypes from './rules/safe-db-types.js';
 
-export const rules = {
+const rules = {
   'aws-client-mandatory-config': awsClientMandatoryConfig,
   'aws-client-shared-config': awsClientSharedConfig,
   'jsx-no-dollar-interpolation': jsxNoDollarInterpolation,
   'no-current-target-in-callback': noCurrentTargetInCallback,
   'no-hydrate-reslocals': noHydrateResLocals,
   'no-unused-sql-blocks': noUnusedSqlBlocks,
+  'require-trpc-permission-middleware': requireTrpcPermissionMiddleware,
   'safe-db-types': safeDbTypes,
 };
+
+export default { rules };

package/src/rules/require-trpc-permission-middleware.ts

@@ -0,0 +1,168 @@
+import { ASTUtils, ESLintUtils, type TSESLint, type TSESTree } from '@typescript-eslint/utils';
+
+const { findVariable } = ASTUtils;
+
+/**
+ * tRPC procedures must enforce their own authorization via a `require*`
+ * permission middleware in the chain.
+ * Individual procedures often need stricter permissions than the page they're
+ * mounted under (e.g. an Edit-only mutation under a route that allows View).
+ * Requiring an explicit permission middleware per procedure makes the
+ * authz gate visible at the call site and helps prevent missing permission checks.
+ *
+ * Bad:
+ * ```ts
+ * const list = t.procedure.query(async ({ ctx }) => { ... });
+ * ```
+ *
+ * Good:
+ * ```ts
+ * const list = t.procedure.use(requireCoursePermissionEdit).query(...);
+ * ```
+ *
+ * Recognized permission middlewares:
+ * - requireCoursePermissionPreview / View / Edit / Own
+ * - requireCourseInstancePermissionPreview / View / Edit / Own
+ * - requireAdministrator
+ *
+ * Feature gates like `requireEnhancedAccessControl` and `requireAiGradingFeature`
+ * don't count — they must be paired with a permission middleware.
+ *
+ * The rule follows intermediate procedure-base variables so patterns like
+ * `const protected = t.procedure.use(...); ...; protected.query(...)` are
+ * checked end-to-end.
+ */
+
+// TODO: This list requires manual maintenance. We should consider making feature gates
+// not use the `require` prefix, and then we can use a more generic pattern here.
+const PERMISSION_MIDDLEWARE_PATTERN =
+  /^require(Course|CourseInstance)Permission(Preview|View|Edit|Own)$|^requireAdministrator$/;
+const TERMINAL_METHODS = new Set(['query', 'mutation', 'subscription']);
+
+function unwrapMemberObject(expr: TSESTree.Expression): TSESTree.Expression {
+  return expr.type === 'TSNonNullExpression' || expr.type === 'TSAsExpression'
+    ? unwrapMemberObject(expr.expression)
+    : expr;
+}
+
+function isTProcedure(expr: TSESTree.Expression): boolean {
+  return (
+    expr.type === 'MemberExpression' &&
+    !expr.computed &&
+    expr.property.type === 'Identifier' &&
+    expr.property.name === 'procedure' &&
+    expr.object.type === 'Identifier' &&
+    expr.object.name === 't'
+  );
+}
+
+interface ChainInfo {
+  matchesTProcedure: boolean;
+  middlewares: string[];
+}
+
+/**
+ * Walks back through a chain like `expr.use(A).input(B).use(C)` collecting
+ * `.use(...)` argument identifiers. If the base of the chain is `t.procedure`,
+ * returns the collected middlewares. If the base is a variable, follows the
+ * variable's initializer (e.g. `const protected = t.procedure.use(X)`).
+ */
+function getProcedureChainInfo(
+  expr: TSESTree.Expression,
+  scope: TSESLint.Scope.Scope,
+  visited: Set<TSESTree.Node>,
+): ChainInfo {
+  if (visited.has(expr)) return { matchesTProcedure: false, middlewares: [] };
+  visited.add(expr);
+
+  const middlewares: string[] = [];
+  let cursor: TSESTree.Expression = expr;
+
+  while (cursor.type === 'CallExpression') {
+    const callee = cursor.callee;
+    if (
+      callee.type !== 'MemberExpression' ||
+      callee.computed ||
+      callee.property.type !== 'Identifier'
+    ) {
+      return { matchesTProcedure: false, middlewares: [] };
+    }
+    if (callee.property.name === 'use' && cursor.arguments[0]?.type === 'Identifier') {
+      middlewares.push(cursor.arguments[0].name);
+    }
+    cursor = callee.object;
+  }
+
+  cursor = unwrapMemberObject(cursor);
+
+  if (isTProcedure(cursor)) {
+    return { matchesTProcedure: true, middlewares };
+  }
+
+  // Follow an intermediate procedure-base variable defined in the same module:
+  //   const protectedProcedure = t.procedure.use(...);
+  //   protectedProcedure.query(...);
+  if (cursor.type === 'Identifier') {
+    const variable = findVariable(scope, cursor);
+    if (variable && variable.defs.length === 1) {
+      const def = variable.defs[0];
+      if (
+        def.node.type === 'VariableDeclarator' &&
+        def.node.init &&
+        // Conservative: only follow `const` bindings to avoid stale data
+        // from let/var rebinding.
+        def.parent?.type === 'VariableDeclaration' &&
+        def.parent.kind === 'const'
+      ) {
+        const upstream = getProcedureChainInfo(def.node.init, scope, visited);
+        if (upstream.matchesTProcedure) {
+          return {
+            matchesTProcedure: true,
+            middlewares: [...middlewares, ...upstream.middlewares],
+          };
+        }
+      }
+    }
+  }
+
+  return { matchesTProcedure: false, middlewares: [] };
+}
+
+export default ESLintUtils.RuleCreator.withoutDocs({
+  meta: {
+    type: 'problem',
+    messages: {
+      missingPermissionMiddleware:
+        'tRPC procedure must call .use() with a permission middleware (e.g. requireCoursePermissionEdit)',
+    },
+    schema: [],
+  },
+  defaultOptions: [],
+
+  create(context) {
+    return {
+      CallExpression(node) {
+        if (
+          node.callee.type !== 'MemberExpression' ||
+          node.callee.computed ||
+          node.callee.property.type !== 'Identifier' ||
+          !TERMINAL_METHODS.has(node.callee.property.name)
+        ) {
+          return;
+        }
+
+        const scope = context.sourceCode.getScope(node);
+        const info = getProcedureChainInfo(node.callee.object, scope, new Set());
+
+        if (!info.matchesTProcedure) return;
+
+        const hasPermissionGate = info.middlewares.some((name) =>
+          PERMISSION_MIDDLEWARE_PATTERN.test(name),
+        );
+        if (!hasPermissionGate) {
+          context.report({ node, messageId: 'missingPermissionMiddleware' });
+        }
+      },
+    };
+  },
+});

package/src/tests/aws-client-mandatory-config.test.ts

@@ -1,7 +1,7 @@
 import { RuleTester } from '@typescript-eslint/rule-tester';
 import { afterAll, describe, it } from 'vitest';
 
-import rule from '../rules/aws-client-mandatory-config';
+import rule from '../rules/aws-client-mandatory-config.js';
 
 RuleTester.afterAll = afterAll;
 RuleTester.describe = describe;

package/src/tests/aws-client-shared-config.test.ts

@@ -1,7 +1,7 @@
 import { RuleTester } from '@typescript-eslint/rule-tester';
 import { afterAll, describe, it } from 'vitest';
 
-import rule from '../rules/aws-client-shared-config';
+import rule from '../rules/aws-client-shared-config.js';
 
 RuleTester.afterAll = afterAll;
 RuleTester.describe = describe;

package/src/tests/jsx-no-dollar-interpolation.test.ts

@@ -1,7 +1,7 @@
 import { RuleTester } from '@typescript-eslint/rule-tester';
 import { afterAll, describe, it } from 'vitest';
 
-import rule from '../rules/jsx-no-dollar-interpolation';
+import rule from '../rules/jsx-no-dollar-interpolation.js';
 
 RuleTester.afterAll = afterAll;
 RuleTester.describe = describe;

package/src/tests/no-hydrate-reslocals.test.ts

@@ -1,7 +1,7 @@
 import { RuleTester } from '@typescript-eslint/rule-tester';
 import { afterAll, describe, it } from 'vitest';
 
-import rule from '../rules/no-hydrate-reslocals';
+import rule from '../rules/no-hydrate-reslocals.js';
 
 RuleTester.afterAll = afterAll;
 RuleTester.describe = describe;

package/src/tests/require-trpc-permission-middleware.test.ts

@@ -0,0 +1,109 @@
+import { RuleTester } from '@typescript-eslint/rule-tester';
+import { afterAll, describe, it } from 'vitest';
+
+import rule from '../rules/require-trpc-permission-middleware.js';
+
+RuleTester.afterAll = afterAll;
+RuleTester.describe = describe;
+RuleTester.it = it;
+
+const ruleTester = new RuleTester();
+
+ruleTester.run('require-trpc-permission-middleware', rule, {
+  valid: [
+    {
+      code: 'const list = t.procedure.use(requireCoursePermissionEdit).query(async () => {});',
+    },
+    {
+      code: 'const m = t.procedure.use(requireCoursePermissionPreview).mutation(async () => {});',
+    },
+    {
+      code: `const m = t.procedure
+        .use(requireEnhancedAccessControl)
+        .use(requireCourseInstancePermissionView)
+        .query(async () => {});`,
+    },
+    {
+      code: 'const m = t.procedure.use(requireAdministrator).mutation(async () => {});',
+    },
+    {
+      code: `const m = t.procedure
+        .use(requireCourseInstancePermissionEdit)
+        .input(z.object({}))
+        .mutation(async () => {});`,
+    },
+    {
+      code: 'const list = t.procedure.use(requireCoursePermissionOwn).query(async () => {});',
+    },
+    // Not a t.procedure chain — should be ignored
+    {
+      code: 'const fn = somethingElse.query(async () => {});',
+    },
+    {
+      code: 'const fn = otherRouter.procedure.query(async () => {});',
+    },
+    // Intermediate procedure-base variable: permission middleware on the base
+    {
+      code: `
+        const protectedProcedure = t.procedure.use(requireCoursePermissionOwn);
+        const m = protectedProcedure.query(async () => {});
+      `,
+    },
+    // Intermediate procedure-base variable: permission added downstream
+    {
+      code: `
+        const featureProcedure = t.procedure.use(requireAiGradingFeature);
+        const m = featureProcedure.use(requireAdministrator).mutation(async () => {});
+      `,
+    },
+    // Imported procedure base — we can't follow across files, so don't fire
+    {
+      code: `
+        import { protectedProcedure } from './foo.js';
+        const m = protectedProcedure.query(async () => {});
+      `,
+      languageOptions: { parserOptions: { sourceType: 'module' } },
+    },
+  ],
+  invalid: [
+    {
+      code: 'const list = t.procedure.query(async () => {});',
+      errors: [{ messageId: 'missingPermissionMiddleware' }],
+    },
+    {
+      code: 'const m = t.procedure.input(z.object({})).mutation(async () => {});',
+      errors: [{ messageId: 'missingPermissionMiddleware' }],
+    },
+    // Feature gate alone is not a permission gate
+    {
+      code: 'const m = t.procedure.use(requireEnhancedAccessControl).mutation(async () => {});',
+      errors: [{ messageId: 'missingPermissionMiddleware' }],
+    },
+    {
+      code: 'const m = t.procedure.use(requireAiGradingFeature).mutation(async () => {});',
+      errors: [{ messageId: 'missingPermissionMiddleware' }],
+    },
+    {
+      code: `const m = t.procedure
+        .input(z.object({}))
+        .output(z.object({}))
+        .subscription(async () => {});`,
+      errors: [{ messageId: 'missingPermissionMiddleware' }],
+    },
+    // Intermediate procedure-base variable with only a feature gate is still a miss
+    {
+      code: `
+        const featureProcedure = t.procedure.use(requireAiGradingFeature);
+        const m = featureProcedure.query(async () => {});
+      `,
+      errors: [{ messageId: 'missingPermissionMiddleware' }],
+    },
+    {
+      code: `
+        const featureProcedure = t.procedure.use(requireAiGradingFeature);
+        const m = featureProcedure.input(z.object({})).mutation(async () => {});
+      `,
+      errors: [{ messageId: 'missingPermissionMiddleware' }],
+    },
+  ],
+});

package/tsconfig.json

@@ -1,9 +1,3 @@
 {
-  // This must be a CJS package because ESLint doesn't support ESM plugins.
-  "extends": "@prairielearn/tsconfig/tsconfig.package-cjs.json",
-  "compilerOptions": {
-    "outDir": "./dist",
-    "rootDir": "./src",
-    "types": ["node"]
-  }
+  "extends": "@prairielearn/tsconfig/tsconfig.package-node.json"
 }