@prairielearn/eslint-plugin 4.1.0 → 4.3.0

package/dist/tests/no-hydrate-reslocals.test.js

@@ -1,15 +1,10 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const rule_tester_1 = require("@typescript-eslint/rule-tester");
-const vitest_1 = require("vitest");
-const no_hydrate_reslocals_1 = __importDefault(require("../rules/no-hydrate-reslocals"));
-rule_tester_1.RuleTester.afterAll = vitest_1.afterAll;
-rule_tester_1.RuleTester.describe = vitest_1.describe;
-rule_tester_1.RuleTester.it = vitest_1.it;
-const ruleTester = new rule_tester_1.RuleTester({
+import { RuleTester } from '@typescript-eslint/rule-tester';
+import { afterAll, describe, it } from 'vitest';
+import rule from '../rules/no-hydrate-reslocals.js';
+RuleTester.afterAll = afterAll;
+RuleTester.describe = describe;
+RuleTester.it = it;
+const ruleTester = new RuleTester({
     languageOptions: {
         parserOptions: {
             ecmaFeatures: {
@@ -18,7 +13,7 @@ const ruleTester = new rule_tester_1.RuleTester({
         },
     },
 });
-ruleTester.run('no-hydrate-reslocals', no_hydrate_reslocals_1.default, {
+ruleTester.run('no-hydrate-reslocals', rule, {
     valid: [
         {
             code: '<Hydrate><Child foo={1} bar="baz" /></Hydrate>',

package/dist/tests/no-hydrate-reslocals.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"no-hydrate-reslocals.test.js","sourceRoot":"","sources":["../../src/tests/no-hydrate-reslocals.test.ts"],"names":[],"mappings":";;;;;AAAA,gEAA4D;AAC5D,mCAAgD;AAEhD,yFAAiD;AAEjD,wBAAU,CAAC,QAAQ,GAAG,iBAAQ,CAAC;AAC/B,wBAAU,CAAC,QAAQ,GAAG,iBAAQ,CAAC;AAC/B,wBAAU,CAAC,EAAE,GAAG,WAAE,CAAC;AAEnB,MAAM,UAAU,GAAG,IAAI,wBAAU,CAAC;IAChC,eAAe,EAAE;QACf,aAAa,EAAE;YACb,YAAY,EAAE;gBACZ,GAAG,EAAE,IAAI;aACV;SACF;KACF;CACF,CAAC,CAAC;AAEH,UAAU,CAAC,GAAG,CAAC,sBAAsB,EAAE,8BAAI,EAAE;IAC3C,KAAK,EAAE;QACL;YACE,IAAI,EAAE,gDAAgD;SACvD;QACD;YACE,IAAI,EAAE,sEAAsE;SAC7E;QACD;YACE,IAAI,EAAE,yDAAyD;SAChE;QACD;YACE,IAAI,EAAE,8CAA8C;SACrD;QACD;YACE,IAAI,EAAE,8CAA8C;SACrD;QACD;YACE,IAAI,EAAE,0CAA0C;SACjD;QACD;YACE,IAAI,EAAE,wCAAwC;SAC/C;QACD;YACE,IAAI,EAAE,iDAAiD;SACxD;KACF;IACD,OAAO,EAAE;QACP;YACE,IAAI,EAAE,qDAAqD;YAC3D,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;SACtE;QACD;YACE,IAAI,EAAE,kDAAkD;YACxD,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;SACnE;QACD;YACE,IAAI,EAAE,8CAA8C;YACpD,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;SAC3C;QACD;YACE,IAAI,EAAE,6CAA6C;YACnD,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;SAC3C;QACD;YACE,IAAI,EAAE,0CAA0C;YAChD,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;SAC3C;QACD;YACE,IAAI,EAAE,wEAAwE;YAC9E,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;SACtE;QACD;YACE,IAAI,EAAE,+CAA+C;YACrD,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;SACtE;QACD;YACE,IAAI,EAAE,4CAA4C;YAClD,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;SACnE;QACD;YACE,IAAI,EAAE,wCAAwC;YAC9C,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;SAC3C;QACD;YACE,IAAI,EAAE,6DAA6D;YACnE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;SAC3C;KACF;CACF,CAAC,CAAC","sourcesContent":["import { RuleTester } from '@typescript-eslint/rule-tester';\nimport { afterAll, describe, it } from 'vitest';\n\nimport rule from '../rules/no-hydrate-reslocals';\n\nRuleTester.afterAll = afterAll;\nRuleTester.describe = describe;\nRuleTester.it = it;\n\nconst ruleTester = new RuleTester({\n  languageOptions: {\n    parserOptions: {\n      ecmaFeatures: {\n        jsx: true,\n      },\n    },\n  },\n});\n\nruleTester.run('no-hydrate-reslocals', rule, {\n  valid: [\n    {\n      code: '<Hydrate><Child foo={1} bar=\"baz\" /></Hydrate>',\n    },\n    {\n      code: '<Hydrate><Child course={course} assessment={assessment} /></Hydrate>',\n    },\n    {\n      code: '<SomeOther resLocals={res.locals}><Child /></SomeOther>',\n    },\n    {\n      code: '<Hydrate><Child {...otherProps} /></Hydrate>',\n    },\n    {\n      code: '<Hydrate resLocals={foo}><Child /></Hydrate>',\n    },\n    {\n      code: 'hydrateHtml(<Child foo={1} bar=\"baz\" />)',\n    },\n    {\n      code: 'hydrateHtml(<Child {...otherProps} />)',\n    },\n    {\n      code: 'otherFunction(<Child resLocals={res.locals} />)',\n    },\n  ],\n  invalid: [\n    {\n      code: '<Hydrate><Child resLocals={res.locals} /></Hydrate>',\n      errors: [{ messageId: 'forbiddenProp', data: { name: 'resLocals' } }],\n    },\n    {\n      code: '<Hydrate><Child locals={res.locals} /></Hydrate>',\n      errors: [{ messageId: 'forbiddenProp', data: { name: 'locals' } }],\n    },\n    {\n      code: '<Hydrate><Child {...res.locals} /></Hydrate>',\n      errors: [{ messageId: 'forbiddenSpread' }],\n    },\n    {\n      code: '<Hydrate><Child {...resLocals} /></Hydrate>',\n      errors: [{ messageId: 'forbiddenSpread' }],\n    },\n    {\n      code: '<Hydrate><Child {...locals} /></Hydrate>',\n      errors: [{ messageId: 'forbiddenSpread' }],\n    },\n    {\n      code: '<Hydrate fullHeight><Child foo={1} resLocals={res.locals} /></Hydrate>',\n      errors: [{ messageId: 'forbiddenProp', data: { name: 'resLocals' } }],\n    },\n    {\n      code: 'hydrateHtml(<Child resLocals={res.locals} />)',\n      errors: [{ messageId: 'forbiddenProp', data: { name: 'resLocals' } }],\n    },\n    {\n      code: 'hydrateHtml(<Child locals={res.locals} />)',\n      errors: [{ messageId: 'forbiddenProp', data: { name: 'locals' } }],\n    },\n    {\n      code: 'hydrateHtml(<Child {...res.locals} />)',\n      errors: [{ messageId: 'forbiddenSpread' }],\n    },\n    {\n      code: 'hydrateHtml(<Child {...resLocals} />, { fullHeight: true })',\n      errors: [{ messageId: 'forbiddenSpread' }],\n    },\n  ],\n});\n"]}
+{"version":3,"file":"no-hydrate-reslocals.test.js","sourceRoot":"","sources":["../../src/tests/no-hydrate-reslocals.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAEhD,OAAO,IAAI,MAAM,kCAAkC,CAAC;AAEpD,UAAU,CAAC,QAAQ,GAAG,QAAQ,CAAC;AAC/B,UAAU,CAAC,QAAQ,GAAG,QAAQ,CAAC;AAC/B,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC;AAEnB,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC;IAChC,eAAe,EAAE;QACf,aAAa,EAAE;YACb,YAAY,EAAE;gBACZ,GAAG,EAAE,IAAI;aACV;SACF;KACF;CACF,CAAC,CAAC;AAEH,UAAU,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE;IAC3C,KAAK,EAAE;QACL;YACE,IAAI,EAAE,gDAAgD;SACvD;QACD;YACE,IAAI,EAAE,sEAAsE;SAC7E;QACD;YACE,IAAI,EAAE,yDAAyD;SAChE;QACD;YACE,IAAI,EAAE,8CAA8C;SACrD;QACD;YACE,IAAI,EAAE,8CAA8C;SACrD;QACD;YACE,IAAI,EAAE,0CAA0C;SACjD;QACD;YACE,IAAI,EAAE,wCAAwC;SAC/C;QACD;YACE,IAAI,EAAE,iDAAiD;SACxD;KACF;IACD,OAAO,EAAE;QACP;YACE,IAAI,EAAE,qDAAqD;YAC3D,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;SACtE;QACD;YACE,IAAI,EAAE,kDAAkD;YACxD,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;SACnE;QACD;YACE,IAAI,EAAE,8CAA8C;YACpD,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;SAC3C;QACD;YACE,IAAI,EAAE,6CAA6C;YACnD,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;SAC3C;QACD;YACE,IAAI,EAAE,0CAA0C;YAChD,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;SAC3C;QACD;YACE,IAAI,EAAE,wEAAwE;YAC9E,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;SACtE;QACD;YACE,IAAI,EAAE,+CAA+C;YACrD,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;SACtE;QACD;YACE,IAAI,EAAE,4CAA4C;YAClD,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;SACnE;QACD;YACE,IAAI,EAAE,wCAAwC;YAC9C,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;SAC3C;QACD;YACE,IAAI,EAAE,6DAA6D;YACnE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;SAC3C;KACF;CACF,CAAC,CAAC","sourcesContent":["import { RuleTester } from '@typescript-eslint/rule-tester';\nimport { afterAll, describe, it } from 'vitest';\n\nimport rule from '../rules/no-hydrate-reslocals.js';\n\nRuleTester.afterAll = afterAll;\nRuleTester.describe = describe;\nRuleTester.it = it;\n\nconst ruleTester = new RuleTester({\n  languageOptions: {\n    parserOptions: {\n      ecmaFeatures: {\n        jsx: true,\n      },\n    },\n  },\n});\n\nruleTester.run('no-hydrate-reslocals', rule, {\n  valid: [\n    {\n      code: '<Hydrate><Child foo={1} bar=\"baz\" /></Hydrate>',\n    },\n    {\n      code: '<Hydrate><Child course={course} assessment={assessment} /></Hydrate>',\n    },\n    {\n      code: '<SomeOther resLocals={res.locals}><Child /></SomeOther>',\n    },\n    {\n      code: '<Hydrate><Child {...otherProps} /></Hydrate>',\n    },\n    {\n      code: '<Hydrate resLocals={foo}><Child /></Hydrate>',\n    },\n    {\n      code: 'hydrateHtml(<Child foo={1} bar=\"baz\" />)',\n    },\n    {\n      code: 'hydrateHtml(<Child {...otherProps} />)',\n    },\n    {\n      code: 'otherFunction(<Child resLocals={res.locals} />)',\n    },\n  ],\n  invalid: [\n    {\n      code: '<Hydrate><Child resLocals={res.locals} /></Hydrate>',\n      errors: [{ messageId: 'forbiddenProp', data: { name: 'resLocals' } }],\n    },\n    {\n      code: '<Hydrate><Child locals={res.locals} /></Hydrate>',\n      errors: [{ messageId: 'forbiddenProp', data: { name: 'locals' } }],\n    },\n    {\n      code: '<Hydrate><Child {...res.locals} /></Hydrate>',\n      errors: [{ messageId: 'forbiddenSpread' }],\n    },\n    {\n      code: '<Hydrate><Child {...resLocals} /></Hydrate>',\n      errors: [{ messageId: 'forbiddenSpread' }],\n    },\n    {\n      code: '<Hydrate><Child {...locals} /></Hydrate>',\n      errors: [{ messageId: 'forbiddenSpread' }],\n    },\n    {\n      code: '<Hydrate fullHeight><Child foo={1} resLocals={res.locals} /></Hydrate>',\n      errors: [{ messageId: 'forbiddenProp', data: { name: 'resLocals' } }],\n    },\n    {\n      code: 'hydrateHtml(<Child resLocals={res.locals} />)',\n      errors: [{ messageId: 'forbiddenProp', data: { name: 'resLocals' } }],\n    },\n    {\n      code: 'hydrateHtml(<Child locals={res.locals} />)',\n      errors: [{ messageId: 'forbiddenProp', data: { name: 'locals' } }],\n    },\n    {\n      code: 'hydrateHtml(<Child {...res.locals} />)',\n      errors: [{ messageId: 'forbiddenSpread' }],\n    },\n    {\n      code: 'hydrateHtml(<Child {...resLocals} />, { fullHeight: true })',\n      errors: [{ messageId: 'forbiddenSpread' }],\n    },\n  ],\n});\n"]}

package/dist/tests/require-trpc-permission-middleware.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=require-trpc-permission-middleware.test.d.ts.map

package/dist/tests/require-trpc-permission-middleware.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-trpc-permission-middleware.test.d.ts","sourceRoot":"","sources":["../../src/tests/require-trpc-permission-middleware.test.ts"],"names":[],"mappings":"","sourcesContent":["import { RuleTester } from '@typescript-eslint/rule-tester';\nimport { afterAll, describe, it } from 'vitest';\n\nimport rule from '../rules/require-trpc-permission-middleware.js';\n\nRuleTester.afterAll = afterAll;\nRuleTester.describe = describe;\nRuleTester.it = it;\n\nconst ruleTester = new RuleTester();\n\nruleTester.run('require-trpc-permission-middleware', rule, {\n  valid: [\n    {\n      code: 'const list = t.procedure.use(requireCoursePermissionEdit).query(async () => {});',\n    },\n    {\n      code: 'const m = t.procedure.use(requireCoursePermissionPreview).mutation(async () => {});',\n    },\n    {\n      code: `const m = t.procedure\n        .use(requireEnhancedAccessControl)\n        .use(requireCourseInstancePermissionView)\n        .query(async () => {});`,\n    },\n    {\n      code: 'const m = t.procedure.use(requireAdministrator).mutation(async () => {});',\n    },\n    {\n      code: `const m = t.procedure\n        .use(requireCourseInstancePermissionEdit)\n        .input(z.object({}))\n        .mutation(async () => {});`,\n    },\n    {\n      code: 'const list = t.procedure.use(requireCoursePermissionOwn).query(async () => {});',\n    },\n    // Not a t.procedure chain — should be ignored\n    {\n      code: 'const fn = somethingElse.query(async () => {});',\n    },\n    {\n      code: 'const fn = otherRouter.procedure.query(async () => {});',\n    },\n    // Intermediate procedure-base variable: permission middleware on the base\n    {\n      code: `\n        const protectedProcedure = t.procedure.use(requireCoursePermissionOwn);\n        const m = protectedProcedure.query(async () => {});\n      `,\n    },\n    // Intermediate procedure-base variable: permission added downstream\n    {\n      code: `\n        const featureProcedure = t.procedure.use(requireAiGradingFeature);\n        const m = featureProcedure.use(requireAdministrator).mutation(async () => {});\n      `,\n    },\n    // Imported procedure base — we can't follow across files, so don't fire\n    {\n      code: `\n        import { protectedProcedure } from './foo.js';\n        const m = protectedProcedure.query(async () => {});\n      `,\n      languageOptions: { parserOptions: { sourceType: 'module' } },\n    },\n  ],\n  invalid: [\n    {\n      code: 'const list = t.procedure.query(async () => {});',\n      errors: [{ messageId: 'missingPermissionMiddleware' }],\n    },\n    {\n      code: 'const m = t.procedure.input(z.object({})).mutation(async () => {});',\n      errors: [{ messageId: 'missingPermissionMiddleware' }],\n    },\n    // Feature gate alone is not a permission gate\n    {\n      code: 'const m = t.procedure.use(requireEnhancedAccessControl).mutation(async () => {});',\n      errors: [{ messageId: 'missingPermissionMiddleware' }],\n    },\n    {\n      code: 'const m = t.procedure.use(requireAiGradingFeature).mutation(async () => {});',\n      errors: [{ messageId: 'missingPermissionMiddleware' }],\n    },\n    {\n      code: `const m = t.procedure\n        .input(z.object({}))\n        .output(z.object({}))\n        .subscription(async () => {});`,\n      errors: [{ messageId: 'missingPermissionMiddleware' }],\n    },\n    // Intermediate procedure-base variable with only a feature gate is still a miss\n    {\n      code: `\n        const featureProcedure = t.procedure.use(requireAiGradingFeature);\n        const m = featureProcedure.query(async () => {});\n      `,\n      errors: [{ messageId: 'missingPermissionMiddleware' }],\n    },\n    {\n      code: `\n        const featureProcedure = t.procedure.use(requireAiGradingFeature);\n        const m = featureProcedure.input(z.object({})).mutation(async () => {});\n      `,\n      errors: [{ messageId: 'missingPermissionMiddleware' }],\n    },\n  ],\n});\n"]}

package/dist/tests/require-trpc-permission-middleware.test.js

@@ -0,0 +1,106 @@
+import { RuleTester } from '@typescript-eslint/rule-tester';
+import { afterAll, describe, it } from 'vitest';
+import rule from '../rules/require-trpc-permission-middleware.js';
+RuleTester.afterAll = afterAll;
+RuleTester.describe = describe;
+RuleTester.it = it;
+const ruleTester = new RuleTester();
+ruleTester.run('require-trpc-permission-middleware', rule, {
+    valid: [
+        {
+            code: 'const list = t.procedure.use(requireCoursePermissionEdit).query(async () => {});',
+        },
+        {
+            code: 'const m = t.procedure.use(requireCoursePermissionPreview).mutation(async () => {});',
+        },
+        {
+            code: `const m = t.procedure
+        .use(requireEnhancedAccessControl)
+        .use(requireCourseInstancePermissionView)
+        .query(async () => {});`,
+        },
+        {
+            code: 'const m = t.procedure.use(requireAdministrator).mutation(async () => {});',
+        },
+        {
+            code: `const m = t.procedure
+        .use(requireCourseInstancePermissionEdit)
+        .input(z.object({}))
+        .mutation(async () => {});`,
+        },
+        {
+            code: 'const list = t.procedure.use(requireCoursePermissionOwn).query(async () => {});',
+        },
+        // Not a t.procedure chain — should be ignored
+        {
+            code: 'const fn = somethingElse.query(async () => {});',
+        },
+        {
+            code: 'const fn = otherRouter.procedure.query(async () => {});',
+        },
+        // Intermediate procedure-base variable: permission middleware on the base
+        {
+            code: `
+        const protectedProcedure = t.procedure.use(requireCoursePermissionOwn);
+        const m = protectedProcedure.query(async () => {});
+      `,
+        },
+        // Intermediate procedure-base variable: permission added downstream
+        {
+            code: `
+        const featureProcedure = t.procedure.use(requireAiGradingFeature);
+        const m = featureProcedure.use(requireAdministrator).mutation(async () => {});
+      `,
+        },
+        // Imported procedure base — we can't follow across files, so don't fire
+        {
+            code: `
+        import { protectedProcedure } from './foo.js';
+        const m = protectedProcedure.query(async () => {});
+      `,
+            languageOptions: { parserOptions: { sourceType: 'module' } },
+        },
+    ],
+    invalid: [
+        {
+            code: 'const list = t.procedure.query(async () => {});',
+            errors: [{ messageId: 'missingPermissionMiddleware' }],
+        },
+        {
+            code: 'const m = t.procedure.input(z.object({})).mutation(async () => {});',
+            errors: [{ messageId: 'missingPermissionMiddleware' }],
+        },
+        // Feature gate alone is not a permission gate
+        {
+            code: 'const m = t.procedure.use(requireEnhancedAccessControl).mutation(async () => {});',
+            errors: [{ messageId: 'missingPermissionMiddleware' }],
+        },
+        {
+            code: 'const m = t.procedure.use(requireAiGradingFeature).mutation(async () => {});',
+            errors: [{ messageId: 'missingPermissionMiddleware' }],
+        },
+        {
+            code: `const m = t.procedure
+        .input(z.object({}))
+        .output(z.object({}))
+        .subscription(async () => {});`,
+            errors: [{ messageId: 'missingPermissionMiddleware' }],
+        },
+        // Intermediate procedure-base variable with only a feature gate is still a miss
+        {
+            code: `
+        const featureProcedure = t.procedure.use(requireAiGradingFeature);
+        const m = featureProcedure.query(async () => {});
+      `,
+            errors: [{ messageId: 'missingPermissionMiddleware' }],
+        },
+        {
+            code: `
+        const featureProcedure = t.procedure.use(requireAiGradingFeature);
+        const m = featureProcedure.input(z.object({})).mutation(async () => {});
+      `,
+            errors: [{ messageId: 'missingPermissionMiddleware' }],
+        },
+    ],
+});
+//# sourceMappingURL=require-trpc-permission-middleware.test.js.map

package/dist/tests/require-trpc-permission-middleware.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-trpc-permission-middleware.test.js","sourceRoot":"","sources":["../../src/tests/require-trpc-permission-middleware.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAEhD,OAAO,IAAI,MAAM,gDAAgD,CAAC;AAElE,UAAU,CAAC,QAAQ,GAAG,QAAQ,CAAC;AAC/B,UAAU,CAAC,QAAQ,GAAG,QAAQ,CAAC;AAC/B,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC;AAEnB,MAAM,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC;AAEpC,UAAU,CAAC,GAAG,CAAC,oCAAoC,EAAE,IAAI,EAAE;IACzD,KAAK,EAAE;QACL;YACE,IAAI,EAAE,kFAAkF;SACzF;QACD;YACE,IAAI,EAAE,qFAAqF;SAC5F;QACD;YACE,IAAI,EAAE;;;gCAGoB;SAC3B;QACD;YACE,IAAI,EAAE,2EAA2E;SAClF;QACD;YACE,IAAI,EAAE;;;mCAGuB;SAC9B;QACD;YACE,IAAI,EAAE,iFAAiF;SACxF;QACD,8CAA8C;QAC9C;YACE,IAAI,EAAE,iDAAiD;SACxD;QACD;YACE,IAAI,EAAE,yDAAyD;SAChE;QACD,0EAA0E;QAC1E;YACE,IAAI,EAAE;;;OAGL;SACF;QACD,oEAAoE;QACpE;YACE,IAAI,EAAE;;;OAGL;SACF;QACD,wEAAwE;QACxE;YACE,IAAI,EAAE;;;OAGL;YACD,eAAe,EAAE,EAAE,aAAa,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE;SAC7D;KACF;IACD,OAAO,EAAE;QACP;YACE,IAAI,EAAE,iDAAiD;YACvD,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,6BAA6B,EAAE,CAAC;SACvD;QACD;YACE,IAAI,EAAE,qEAAqE;YAC3E,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,6BAA6B,EAAE,CAAC;SACvD;QACD,8CAA8C;QAC9C;YACE,IAAI,EAAE,mFAAmF;YACzF,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,6BAA6B,EAAE,CAAC;SACvD;QACD;YACE,IAAI,EAAE,8EAA8E;YACpF,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,6BAA6B,EAAE,CAAC;SACvD;QACD;YACE,IAAI,EAAE;;;uCAG2B;YACjC,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,6BAA6B,EAAE,CAAC;SACvD;QACD,gFAAgF;QAChF;YACE,IAAI,EAAE;;;OAGL;YACD,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,6BAA6B,EAAE,CAAC;SACvD;QACD;YACE,IAAI,EAAE;;;OAGL;YACD,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,6BAA6B,EAAE,CAAC;SACvD;KACF;CACF,CAAC,CAAC","sourcesContent":["import { RuleTester } from '@typescript-eslint/rule-tester';\nimport { afterAll, describe, it } from 'vitest';\n\nimport rule from '../rules/require-trpc-permission-middleware.js';\n\nRuleTester.afterAll = afterAll;\nRuleTester.describe = describe;\nRuleTester.it = it;\n\nconst ruleTester = new RuleTester();\n\nruleTester.run('require-trpc-permission-middleware', rule, {\n  valid: [\n    {\n      code: 'const list = t.procedure.use(requireCoursePermissionEdit).query(async () => {});',\n    },\n    {\n      code: 'const m = t.procedure.use(requireCoursePermissionPreview).mutation(async () => {});',\n    },\n    {\n      code: `const m = t.procedure\n        .use(requireEnhancedAccessControl)\n        .use(requireCourseInstancePermissionView)\n        .query(async () => {});`,\n    },\n    {\n      code: 'const m = t.procedure.use(requireAdministrator).mutation(async () => {});',\n    },\n    {\n      code: `const m = t.procedure\n        .use(requireCourseInstancePermissionEdit)\n        .input(z.object({}))\n        .mutation(async () => {});`,\n    },\n    {\n      code: 'const list = t.procedure.use(requireCoursePermissionOwn).query(async () => {});',\n    },\n    // Not a t.procedure chain — should be ignored\n    {\n      code: 'const fn = somethingElse.query(async () => {});',\n    },\n    {\n      code: 'const fn = otherRouter.procedure.query(async () => {});',\n    },\n    // Intermediate procedure-base variable: permission middleware on the base\n    {\n      code: `\n        const protectedProcedure = t.procedure.use(requireCoursePermissionOwn);\n        const m = protectedProcedure.query(async () => {});\n      `,\n    },\n    // Intermediate procedure-base variable: permission added downstream\n    {\n      code: `\n        const featureProcedure = t.procedure.use(requireAiGradingFeature);\n        const m = featureProcedure.use(requireAdministrator).mutation(async () => {});\n      `,\n    },\n    // Imported procedure base — we can't follow across files, so don't fire\n    {\n      code: `\n        import { protectedProcedure } from './foo.js';\n        const m = protectedProcedure.query(async () => {});\n      `,\n      languageOptions: { parserOptions: { sourceType: 'module' } },\n    },\n  ],\n  invalid: [\n    {\n      code: 'const list = t.procedure.query(async () => {});',\n      errors: [{ messageId: 'missingPermissionMiddleware' }],\n    },\n    {\n      code: 'const m = t.procedure.input(z.object({})).mutation(async () => {});',\n      errors: [{ messageId: 'missingPermissionMiddleware' }],\n    },\n    // Feature gate alone is not a permission gate\n    {\n      code: 'const m = t.procedure.use(requireEnhancedAccessControl).mutation(async () => {});',\n      errors: [{ messageId: 'missingPermissionMiddleware' }],\n    },\n    {\n      code: 'const m = t.procedure.use(requireAiGradingFeature).mutation(async () => {});',\n      errors: [{ messageId: 'missingPermissionMiddleware' }],\n    },\n    {\n      code: `const m = t.procedure\n        .input(z.object({}))\n        .output(z.object({}))\n        .subscription(async () => {});`,\n      errors: [{ messageId: 'missingPermissionMiddleware' }],\n    },\n    // Intermediate procedure-base variable with only a feature gate is still a miss\n    {\n      code: `\n        const featureProcedure = t.procedure.use(requireAiGradingFeature);\n        const m = featureProcedure.query(async () => {});\n      `,\n      errors: [{ messageId: 'missingPermissionMiddleware' }],\n    },\n    {\n      code: `\n        const featureProcedure = t.procedure.use(requireAiGradingFeature);\n        const m = featureProcedure.input(z.object({})).mutation(async () => {});\n      `,\n      errors: [{ messageId: 'missingPermissionMiddleware' }],\n    },\n  ],\n});\n"]}

package/dist/utils.js

@@ -1,6 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.getAwsClientNamesFromImportDeclaration = getAwsClientNamesFromImportDeclaration;
 /**
  * Determines if the given identifier name corresponds to a client from the
  * given package.
@@ -29,7 +26,7 @@ function isIdentifierClient(identifierName, packageName) {
  *
  * then this function will return a set containing the strings "S3" and "S3Client".
  */
-function getAwsClientNamesFromImportDeclaration(node) {
+export function getAwsClientNamesFromImportDeclaration(node) {
     const clientNames = new Set();
     const importSource = node.source.value;
     if (importSource.startsWith('@aws-sdk/client-')) {

package/dist/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,SAAS,kBAAkB,CAAC,cAAsB,EAAE,WAAmB;IACrE,+DAA+D;IAC/D,IAAI,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8EAA8E;IAC9E,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACvE,IAAI,cAAc,CAAC,WAAW,EAAE,KAAK,iBAAiB,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,gDAAuD,IAAS;IAC9D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IAEtC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;IACvC,IAAI,YAAY,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,SAAc,EAAE,EAAE;YACzC,IAAI,SAAS,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBACzC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC9C,IAAI,kBAAkB,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE,CAAC;oBACpD,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBACjC,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["/**\n * Determines if the given identifier name corresponds to a client from the\n * given package.\n */\nfunction isIdentifierClient(identifierName: string, packageName: string): boolean {\n  // If the identifier ends with \"Client\", include it in the set.\n  if (identifierName.endsWith('Client')) {\n    return true;\n  }\n\n  // If the identifier matches the package name directly, include it in the set.\n  const clientName = packageName.replace('@aws-sdk/client-', '');\n  const packageIdentifier = clientName.replaceAll('-', '').toLowerCase();\n  if (identifierName.toLowerCase() === packageIdentifier) {\n    return true;\n  }\n\n  return false;\n}\n\n/**\n * Retrieves the names of AWS clients specified by the given import declaration.\n *\n * For instance, if the import declaration is:\n *\n * ```ts\n * import { S3, S3Client } from '@aws-sdk/client-s3';\n * ```\n *\n * then this function will return a set containing the strings \"S3\" and \"S3Client\".\n */\nexport function getAwsClientNamesFromImportDeclaration(node: any) {\n  const clientNames = new Set<string>();\n\n  const importSource = node.source.value;\n  if (importSource.startsWith('@aws-sdk/client-')) {\n    node.specifiers.forEach((specifier: any) => {\n      if (specifier.type === 'ImportSpecifier') {\n        const specifierName = specifier.imported.name;\n        if (isIdentifierClient(specifierName, importSource)) {\n          clientNames.add(specifierName);\n        }\n      }\n    });\n  }\n\n  return clientNames;\n}\n"]}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,SAAS,kBAAkB,CAAC,cAAsB,EAAE,WAAmB;IACrE,+DAA+D;IAC/D,IAAI,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8EAA8E;IAC9E,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACvE,IAAI,cAAc,CAAC,WAAW,EAAE,KAAK,iBAAiB,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sCAAsC,CAAC,IAAS;IAC9D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IAEtC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;IACvC,IAAI,YAAY,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,SAAc,EAAE,EAAE;YACzC,IAAI,SAAS,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBACzC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC9C,IAAI,kBAAkB,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE,CAAC;oBACpD,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBACjC,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["/**\n * Determines if the given identifier name corresponds to a client from the\n * given package.\n */\nfunction isIdentifierClient(identifierName: string, packageName: string): boolean {\n  // If the identifier ends with \"Client\", include it in the set.\n  if (identifierName.endsWith('Client')) {\n    return true;\n  }\n\n  // If the identifier matches the package name directly, include it in the set.\n  const clientName = packageName.replace('@aws-sdk/client-', '');\n  const packageIdentifier = clientName.replaceAll('-', '').toLowerCase();\n  if (identifierName.toLowerCase() === packageIdentifier) {\n    return true;\n  }\n\n  return false;\n}\n\n/**\n * Retrieves the names of AWS clients specified by the given import declaration.\n *\n * For instance, if the import declaration is:\n *\n * ```ts\n * import { S3, S3Client } from '@aws-sdk/client-s3';\n * ```\n *\n * then this function will return a set containing the strings \"S3\" and \"S3Client\".\n */\nexport function getAwsClientNamesFromImportDeclaration(node: any) {\n  const clientNames = new Set<string>();\n\n  const importSource = node.source.value;\n  if (importSource.startsWith('@aws-sdk/client-')) {\n    node.specifiers.forEach((specifier: any) => {\n      if (specifier.type === 'ImportSpecifier') {\n        const specifierName = specifier.imported.name;\n        if (isIdentifierClient(specifierName, importSource)) {\n          clientNames.add(specifierName);\n        }\n      }\n    });\n  }\n\n  return clientNames;\n}\n"]}

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@prairielearn/eslint-plugin",
-  "version": "4.1.0",
+  "version": "4.3.0",
+  "type": "module",
   "repository": {
     "type": "git",
     "url": "https://github.com/PrairieLearn/PrairieLearn.git",
@@ -19,17 +20,17 @@
     "eslint": "^10.0.0"
   },
   "dependencies": {
-    "@typescript-eslint/utils": "^8.58.0",
-    "typescript": "^5.9.3"
+    "@typescript-eslint/utils": "^8.59.2",
+    "typescript": "^6.0.3"
   },
   "devDependencies": {
-    "@prairielearn/tsconfig": "^2.0.0",
+    "@html-eslint/parser": "^0.58.1",
+    "@prairielearn/tsconfig": "^2.1.0",
     "@types/node": "^24.12.2",
-    "@typescript-eslint/rule-tester": "^8.58.0",
-    "@typescript-eslint/types": "^8.58.0",
-    "@typescript/native-preview": "^7.0.0-dev.20260305.1",
-    "@vitest/coverage-v8": "^4.1.2",
-    "tsx": "^4.21.0",
-    "vitest": "^4.1.2"
+    "@typescript-eslint/rule-tester": "^8.59.2",
+    "@typescript-eslint/types": "^8.59.2",
+    "@typescript/native-preview": "beta",
+    "@vitest/coverage-v8": "^4.1.5",
+    "vitest": "^4.1.5"
   }
 }

package/src/index.ts

@@ -1,17 +1,23 @@
 import awsClientMandatoryConfig from './rules/aws-client-mandatory-config.js';
 import awsClientSharedConfig from './rules/aws-client-shared-config.js';
+import htmlNoDuplicateId from './rules/html-no-duplicate-id.js';
 import jsxNoDollarInterpolation from './rules/jsx-no-dollar-interpolation.js';
 import noCurrentTargetInCallback from './rules/no-current-target-in-callback.js';
 import noHydrateResLocals from './rules/no-hydrate-reslocals.js';
 import noUnusedSqlBlocks from './rules/no-unused-sql-blocks.js';
+import requireTrpcPermissionMiddleware from './rules/require-trpc-permission-middleware.js';
 import safeDbTypes from './rules/safe-db-types.js';
 
-export const rules = {
+const rules = {
   'aws-client-mandatory-config': awsClientMandatoryConfig,
   'aws-client-shared-config': awsClientSharedConfig,
+  'html-no-duplicate-id': htmlNoDuplicateId,
   'jsx-no-dollar-interpolation': jsxNoDollarInterpolation,
   'no-current-target-in-callback': noCurrentTargetInCallback,
   'no-hydrate-reslocals': noHydrateResLocals,
   'no-unused-sql-blocks': noUnusedSqlBlocks,
+  'require-trpc-permission-middleware': requireTrpcPermissionMiddleware,
   'safe-db-types': safeDbTypes,
 };
+
+export default { rules };

package/src/rules/html-no-duplicate-id.ts

@@ -0,0 +1,76 @@
+import { ESLintUtils } from '@typescript-eslint/utils';
+
+interface AttributeValueNode {
+  type: 'AttributeValue';
+  value: string;
+  parts?: { type: string }[];
+}
+
+interface AttributeKeyNode {
+  type: 'AttributeKey';
+  value: string;
+}
+
+interface AttributeNode {
+  type: 'Attribute';
+  key: AttributeKeyNode;
+  value?: AttributeValueNode;
+}
+
+interface TagNode {
+  type: 'Tag';
+  name: string;
+  attributes: AttributeNode[];
+}
+
+function findIdAttr(node: TagNode): AttributeNode | undefined {
+  return node.attributes.find((attr) => attr.key && attr.key.value.toLowerCase() === 'id');
+}
+
+function hasTemplatePart(node: AttributeValueNode): boolean {
+  return node.parts?.some((part) => part.type === 'Template') ?? false;
+}
+
+/**
+ * Variant of `@html-eslint/no-duplicate-id` that ignores tags whose names start
+ * with `pl-`. The `id` attribute on PrairieLearn elements (e.g. `pl-sketch-tool
+ * id="fd"`) is not a DOM id, it's an element-specific identifier consumed by
+ * the parent element, so duplicates across separate parents are legal.
+ */
+export default ESLintUtils.RuleCreator.withoutDocs({
+  meta: {
+    type: 'problem',
+    messages: {
+      duplicateId: "The id '{{id}}' is duplicated.",
+    },
+    schema: [],
+  },
+  defaultOptions: [],
+  create(context) {
+    const idAttrs = new Map<string, AttributeValueNode[]>();
+
+    return {
+      Tag(node: TagNode) {
+        if (node.name.toLowerCase().startsWith('pl-')) return;
+        const idAttr = findIdAttr(node);
+        if (!idAttr?.value) return;
+        if (hasTemplatePart(idAttr.value)) return;
+        const list = idAttrs.get(idAttr.value.value) ?? [];
+        list.push(idAttr.value);
+        idAttrs.set(idAttr.value.value, list);
+      },
+      'Document:exit'() {
+        for (const attrs of idAttrs.values()) {
+          if (attrs.length <= 1) continue;
+          for (const attr of attrs) {
+            context.report({
+              node: attr as never,
+              data: { id: attr.value },
+              messageId: 'duplicateId',
+            });
+          }
+        }
+      },
+    };
+  },
+});

package/src/rules/require-trpc-permission-middleware.ts

@@ -0,0 +1,168 @@
+import { ASTUtils, ESLintUtils, type TSESLint, type TSESTree } from '@typescript-eslint/utils';
+
+const { findVariable } = ASTUtils;
+
+/**
+ * tRPC procedures must enforce their own authorization via a `require*`
+ * permission middleware in the chain.
+ * Individual procedures often need stricter permissions than the page they're
+ * mounted under (e.g. an Edit-only mutation under a route that allows View).
+ * Requiring an explicit permission middleware per procedure makes the
+ * authz gate visible at the call site and helps prevent missing permission checks.
+ *
+ * Bad:
+ * ```ts
+ * const list = t.procedure.query(async ({ ctx }) => { ... });
+ * ```
+ *
+ * Good:
+ * ```ts
+ * const list = t.procedure.use(requireCoursePermissionEdit).query(...);
+ * ```
+ *
+ * Recognized permission middlewares:
+ * - requireCoursePermissionPreview / View / Edit / Own
+ * - requireCourseInstancePermissionPreview / View / Edit / Own
+ * - requireAdministrator
+ *
+ * Feature gates like `requireEnhancedAccessControl` and `requireAiGradingFeature`
+ * don't count — they must be paired with a permission middleware.
+ *
+ * The rule follows intermediate procedure-base variables so patterns like
+ * `const protected = t.procedure.use(...); ...; protected.query(...)` are
+ * checked end-to-end.
+ */
+
+// TODO: This list requires manual maintenance. We should consider making feature gates
+// not use the `require` prefix, and then we can use a more generic pattern here.
+const PERMISSION_MIDDLEWARE_PATTERN =
+  /^require(Course|CourseInstance)Permission(Preview|View|Edit|Own)$|^requireAdministrator$/;
+const TERMINAL_METHODS = new Set(['query', 'mutation', 'subscription']);
+
+function unwrapMemberObject(expr: TSESTree.Expression): TSESTree.Expression {
+  return expr.type === 'TSNonNullExpression' || expr.type === 'TSAsExpression'
+    ? unwrapMemberObject(expr.expression)
+    : expr;
+}
+
+function isTProcedure(expr: TSESTree.Expression): boolean {
+  return (
+    expr.type === 'MemberExpression' &&
+    !expr.computed &&
+    expr.property.type === 'Identifier' &&
+    expr.property.name === 'procedure' &&
+    expr.object.type === 'Identifier' &&
+    expr.object.name === 't'
+  );
+}
+
+interface ChainInfo {
+  matchesTProcedure: boolean;
+  middlewares: string[];
+}
+
+/**
+ * Walks back through a chain like `expr.use(A).input(B).use(C)` collecting
+ * `.use(...)` argument identifiers. If the base of the chain is `t.procedure`,
+ * returns the collected middlewares. If the base is a variable, follows the
+ * variable's initializer (e.g. `const protected = t.procedure.use(X)`).
+ */
+function getProcedureChainInfo(
+  expr: TSESTree.Expression,
+  scope: TSESLint.Scope.Scope,
+  visited: Set<TSESTree.Node>,
+): ChainInfo {
+  if (visited.has(expr)) return { matchesTProcedure: false, middlewares: [] };
+  visited.add(expr);
+
+  const middlewares: string[] = [];
+  let cursor: TSESTree.Expression = expr;
+
+  while (cursor.type === 'CallExpression') {
+    const callee = cursor.callee;
+    if (
+      callee.type !== 'MemberExpression' ||
+      callee.computed ||
+      callee.property.type !== 'Identifier'
+    ) {
+      return { matchesTProcedure: false, middlewares: [] };
+    }
+    if (callee.property.name === 'use' && cursor.arguments[0]?.type === 'Identifier') {
+      middlewares.push(cursor.arguments[0].name);
+    }
+    cursor = callee.object;
+  }
+
+  cursor = unwrapMemberObject(cursor);
+
+  if (isTProcedure(cursor)) {
+    return { matchesTProcedure: true, middlewares };
+  }
+
+  // Follow an intermediate procedure-base variable defined in the same module:
+  //   const protectedProcedure = t.procedure.use(...);
+  //   protectedProcedure.query(...);
+  if (cursor.type === 'Identifier') {
+    const variable = findVariable(scope, cursor);
+    if (variable && variable.defs.length === 1) {
+      const def = variable.defs[0];
+      if (
+        def.node.type === 'VariableDeclarator' &&
+        def.node.init &&
+        // Conservative: only follow `const` bindings to avoid stale data
+        // from let/var rebinding.
+        def.parent?.type === 'VariableDeclaration' &&
+        def.parent.kind === 'const'
+      ) {
+        const upstream = getProcedureChainInfo(def.node.init, scope, visited);
+        if (upstream.matchesTProcedure) {
+          return {
+            matchesTProcedure: true,
+            middlewares: [...middlewares, ...upstream.middlewares],
+          };
+        }
+      }
+    }
+  }
+
+  return { matchesTProcedure: false, middlewares: [] };
+}
+
+export default ESLintUtils.RuleCreator.withoutDocs({
+  meta: {
+    type: 'problem',
+    messages: {
+      missingPermissionMiddleware:
+        'tRPC procedure must call .use() with a permission middleware (e.g. requireCoursePermissionEdit)',
+    },
+    schema: [],
+  },
+  defaultOptions: [],
+
+  create(context) {
+    return {
+      CallExpression(node) {
+        if (
+          node.callee.type !== 'MemberExpression' ||
+          node.callee.computed ||
+          node.callee.property.type !== 'Identifier' ||
+          !TERMINAL_METHODS.has(node.callee.property.name)
+        ) {
+          return;
+        }
+
+        const scope = context.sourceCode.getScope(node);
+        const info = getProcedureChainInfo(node.callee.object, scope, new Set());
+
+        if (!info.matchesTProcedure) return;
+
+        const hasPermissionGate = info.middlewares.some((name) =>
+          PERMISSION_MIDDLEWARE_PATTERN.test(name),
+        );
+        if (!hasPermissionGate) {
+          context.report({ node, messageId: 'missingPermissionMiddleware' });
+        }
+      },
+    };
+  },
+});

package/src/tests/aws-client-mandatory-config.test.ts

@@ -1,7 +1,7 @@
 import { RuleTester } from '@typescript-eslint/rule-tester';
 import { afterAll, describe, it } from 'vitest';
 
-import rule from '../rules/aws-client-mandatory-config';
+import rule from '../rules/aws-client-mandatory-config.js';
 
 RuleTester.afterAll = afterAll;
 RuleTester.describe = describe;

package/src/tests/aws-client-shared-config.test.ts

@@ -1,7 +1,7 @@
 import { RuleTester } from '@typescript-eslint/rule-tester';
 import { afterAll, describe, it } from 'vitest';
 
-import rule from '../rules/aws-client-shared-config';
+import rule from '../rules/aws-client-shared-config.js';
 
 RuleTester.afterAll = afterAll;
 RuleTester.describe = describe;

package/src/tests/html-no-duplicate-id.test.ts

@@ -0,0 +1,57 @@
+import htmlParser from '@html-eslint/parser';
+import { RuleTester } from '@typescript-eslint/rule-tester';
+import { afterAll, describe, it } from 'vitest';
+
+import rule from '../rules/html-no-duplicate-id.js';
+
+RuleTester.afterAll = afterAll;
+RuleTester.describe = describe;
+RuleTester.it = it;
+
+const ruleTester = new RuleTester({
+  languageOptions: {
+    parser: htmlParser,
+    parserOptions: {
+      templateEngineSyntax: htmlParser.TEMPLATE_ENGINE_SYNTAX.HANDLEBAR,
+    },
+  },
+});
+
+ruleTester.run('html-no-duplicate-id', rule, {
+  valid: [
+    {
+      code: '<div id="a"></div><div id="b"></div>',
+    },
+    // Duplicate `id` on `pl-*` elements is a tool/element identifier, not a
+    // DOM id, so it should be ignored.
+    {
+      code: `
+        <pl-sketch>
+          <pl-sketch-tool id="fd" type="free-draw"></pl-sketch-tool>
+        </pl-sketch>
+        <pl-sketch>
+          <pl-sketch-tool id="fd" type="free-draw"></pl-sketch-tool>
+        </pl-sketch>`,
+    },
+    {
+      code: '<div id="question-{{params.name}}"></div><span id="question-{{params.name}}"></span>',
+    },
+  ],
+  invalid: [
+    {
+      code: '<div id="x"></div><div id="x"></div>',
+      errors: [
+        { messageId: 'duplicateId', data: { id: 'x' } },
+        { messageId: 'duplicateId', data: { id: 'x' } },
+      ],
+    },
+    // Duplicate `id` on non-`pl-*` elements should be reported.
+    {
+      code: '<div id="fd"></div><span id="fd"></span>',
+      errors: [
+        { messageId: 'duplicateId', data: { id: 'fd' } },
+        { messageId: 'duplicateId', data: { id: 'fd' } },
+      ],
+    },
+  ],
+});

package/src/tests/jsx-no-dollar-interpolation.test.ts

@@ -1,7 +1,7 @@
 import { RuleTester } from '@typescript-eslint/rule-tester';
 import { afterAll, describe, it } from 'vitest';
 
-import rule from '../rules/jsx-no-dollar-interpolation';
+import rule from '../rules/jsx-no-dollar-interpolation.js';
 
 RuleTester.afterAll = afterAll;
 RuleTester.describe = describe;

package/src/tests/no-hydrate-reslocals.test.ts

@@ -1,7 +1,7 @@
 import { RuleTester } from '@typescript-eslint/rule-tester';
 import { afterAll, describe, it } from 'vitest';
 
-import rule from '../rules/no-hydrate-reslocals';
+import rule from '../rules/no-hydrate-reslocals.js';
 
 RuleTester.afterAll = afterAll;
 RuleTester.describe = describe;