@starci/eslint-canon-be 2.1.1 → 3.0.0

package/data-access.mjs

@@ -10,7 +10,9 @@
  *   connection. A lookalike (`InjectFooEntityManager`) or a bare `InjectEntityManager()` is not one.
  * - `named-entity-manager-only` - no property injection of an `EntityManager`, `DataSource` or `QueryRunner`; a
  *   `DataSource` or `QueryRunner` is injected only in the platform database capability and the migrate app; no
- *   `getRepository(...)` on a manager or data source.
+ *   `getRepository(...)` on a manager or data source; and outside those places no type reference, awaited value,
+ *   or `provide:` token is a `DataSource` or `QueryRunner` (a wrapper service that exposes one is the same door), and no
+ *   class receives a wrapper class that exposes one.
  * - `no-injected-repository` - no `@InjectRepository`, no `Repository<T>` type, no `TypeOrmModule.forFeature`.
  * - `require-entity-table-name` - `@Entity()` names its table.
  * - `no-outer-manager-in-transaction` - inside `<manager>.transaction(async (tx) => ...)` every call uses `tx`; any other
@@ -20,16 +22,19 @@
  *   `integrations/**`, `HttpClient` or `MessagePublisher`, and no `fetch`.
  */
 
+import ts from "typescript"
 import { walk } from "./lib/ast.mjs"
 import { hfsOf } from "./lib/hfs.mjs"
 import {
     declaredInjectorNames,
     inDatabaseCapability,
     inMigrateApp, inTestBootstrap,
+    implementsMigration,
     infraTypeOf,
     injectionSites,
+    isMigrationFile,
 } from "./lib/persistence.mjs"
-import { isPackageType, typeOrigins } from "./lib/types.mjs"
+import { isPackageType, originsOfType, typed, typeOrigins } from "./lib/types.mjs"
 
 /** The `typeorm` repository types no class receives. */
 const REPOSITORY_TYPES = ["Repository", "TreeRepository", "MongoRepository"]
@@ -72,6 +77,12 @@ export const namedEntityManagerOnly = {
                 "`{{type}}` is injected as a class property. Property injection hides the dependency from the constructor and the app module. Receive the named-injector `EntityManager` as a constructor parameter.",
             infra:
                 "`{{type}}` is injected here. A `DataSource` or `QueryRunner` is built and held only by the platform database capability, the migrate app and the test world in `src/tests/world`; specs take `world.db.<connection>`; everything else injects the shared `EntityManager` through its named injector and calls it directly.",
+            exposed:
+                "`{{type}}` is written here outside the platform database capability, the migrate app and the test world. A wrapper service that returns, holds or hands out a connection is the same door as injecting it: the connection is opened and held only by `platform/database`, and everything else calls the shared EntityManager through its named injector.",
+            token:
+                "This provider is bound to a `{{type}}`. A token that resolves to a connection object is a second door to the database: only `platform/database`, the migrate app and the test world provide one.",
+            wrapper:
+                "`{{wrapper}}` exposes a `{{type}}` through `{{member}}`, and this class receives it. A connection wrapper is not a service dependency: inject the shared EntityManager with its named injector and call it directly.",
             getRepository:
                 "`.getRepository(...)` binds a handle to ONE entity and hides which connection it came from. Call the shared manager directly: `manager.find(Entity, ...)`, `manager.save(Entity, ...)`, `tx.insert(Entity, ...)`.",
         },
@@ -79,15 +90,100 @@ export const namedEntityManagerOnly = {
     create(context) {
         const hfs = hfsOf(context)
         const filename = context.filename || context.getFilename()
-        const mayHoldConnections = inDatabaseCapability(hfs, filename) || inMigrateApp(hfs, filename) || inTestBootstrap(hfs, filename)
+        const mayHoldConnections = inDatabaseCapability(hfs, filename) || inMigrateApp(hfs, filename) || inTestBootstrap(hfs, filename) || isMigrationFile(hfs, filename)
+        const CONNECTION_TYPES = new Set(["DataSource", "QueryRunner"])
+        /** The connection type (DataSource / QueryRunner) a value or written type is declared as, else null. */
+        const connectionTypeOf = (node) => {
+            const type = infraTypeOf(context, node)
+            return type !== null && CONNECTION_TYPES.has(type) ? type : null
+        }
+        /** The connection type of a checker type (awaited), else null. */
+        const connectionOfType = (type) => {
+            if (!type) return null
+            const { checker } = typed(context)
+            const awaited = checker.getAwaitedType(type) ?? type
+            const origin = originsOfType(checker, awaited).find((entry) => entry.module === "typeorm" && CONNECTION_TYPES.has(entry.name))
+            return origin ? origin.name : null
+        }
+        /** True when the node sits inside a class that implements typeorm's `MigrationInterface` (it receives a `QueryRunner` by contract). */
+        const insideMigrationClass = (node) => {
+            for (let current = node.parent; current; current = current.parent) {
+                if ((current.type === "ClassDeclaration" || current.type === "ClassExpression") && implementsMigration(context, current)) return true
+            }
+            return false
+        }
+        /** The annotation of the constructor parameter or class property that contains this type node, else null. */
+        const siteAnnotationOf = (node) => {
+            for (let current = node.parent; current; current = current.parent) {
+                if (current.type !== "TSTypeAnnotation") continue
+                const owner = current.parent
+                const isProperty = owner?.type === "PropertyDefinition"
+                const isParam = owner?.type === "Identifier" && (owner.parent?.type === "TSParameterProperty"
+                    || (owner.parent?.type === "FunctionExpression" && owner.parent.parent?.type === "MethodDefinition" && owner.parent.parent.kind === "constructor"))
+                return isProperty || isParam ? current.typeAnnotation : null
+            }
+            return null
+        }
+        /** The member of a repository-declared class type that hands out a connection: `{ member, type, wrapper }`, else null. */
+        const exposedConnection = (annotation) => {
+            const { checker, toTs } = typed(context)
+            const tsNode = toTs(annotation)
+            if (!tsNode) return null
+            const type = checker.getTypeFromTypeNode(tsNode)
+            const symbol = type.getSymbol()
+            const declaration = symbol && symbol.flags & ts.SymbolFlags.Class ? symbol.declarations?.[0] : null
+            if (!declaration || declaration.getSourceFile().fileName.replace(/\\/g, "/").includes("/node_modules/")) return null
+            for (const property of checker.getPropertiesOfType(type)) {
+                if (property.declarations?.some((entry) => ts.getCombinedModifierFlags(entry) & (ts.ModifierFlags.Private | ts.ModifierFlags.Protected))) continue
+                const memberType = checker.getTypeOfSymbolAtLocation(property, tsNode)
+                for (const candidate of [memberType, ...memberType.getCallSignatures().map((signature) => signature.getReturnType())]) {
+                    const found = connectionOfType(candidate)
+                    if (found) return { member: property.getName(), type: found, wrapper: symbol.getName() }
+                }
+            }
+            return null
+        }
         return {
             ...injectionSites(({ node, kind, annotation }) => {
                 if (!annotation) return
                 const type = infraTypeOf(context, annotation)
-                if (!type) return
+                if (!type) {
+                    const wrapper = kind === "param" && !mayHoldConnections ? exposedConnection(annotation) : null
+                    if (wrapper) context.report({ node, messageId: "wrapper", data: wrapper })
+                    return
+                }
                 if (kind === "property") context.report({ node, messageId: "property", data: { type } })
                 else if (type !== "EntityManager" && !mayHoldConnections) context.report({ node, messageId: "infra", data: { type } })
             }),
+            TSTypeReference(node) {
+                if (mayHoldConnections) return
+                const type = connectionTypeOf(node)
+                if (!type || insideMigrationClass(node)) return
+                const site = siteAnnotationOf(node)
+                if (site && infraTypeOf(context, site)) return
+                context.report({ node, messageId: "exposed", data: { type } })
+            },
+            AwaitExpression(node) {
+                if (mayHoldConnections || insideMigrationClass(node)) return
+                const { checker, toTs } = typed(context)
+                const tsNode = toTs(node)
+                const type = tsNode ? connectionOfType(checker.getTypeAtLocation(tsNode)) : null
+                if (type) context.report({ node, messageId: "exposed", data: { type } })
+            },
+            Property(node) {
+                if (mayHoldConnections || node.parent?.type !== "ObjectExpression" || node.computed) return
+                if ((node.key.type === "Identifier" ? node.key.name : node.key.value) !== "provide") return
+                const { checker, toTs } = typed(context)
+                for (const sibling of node.parent.properties) {
+                    if (sibling.type !== "Property" || sibling.computed || sibling.key.type !== "Identifier") continue
+                    const tsNode = toTs(sibling.value)
+                    if (!tsNode) continue
+                    const type = checker.getTypeAtLocation(tsNode)
+                    const provided = sibling.key.name === "useValue" ? type : sibling.key.name === "useFactory" ? type.getCallSignatures()[0]?.getReturnType() : null
+                    const found = connectionOfType(provided)
+                    if (found) context.report({ node, messageId: "token", data: { type: found } })
+                }
+            },
             CallExpression(node) {
                 const callee = node.callee
                 if (callee.type !== "MemberExpression" || callee.computed || callee.property.type !== "Identifier") return

package/error-handling.mjs

@@ -1,11 +1,16 @@
 /**
- * The rules that hold HFS errors and their handling (catalog R38 `BE_ERROR_HOME`, R40 `BE_LOGGER_REQUIRED`).
+ * The rules that hold HFS errors and their handling (catalog R38 `BE_ERROR_HOME`, R40 `BE_LOGGER_REQUIRED`, R108
+ * `BE_ERROR_CAUSE_DROPPED`).
  *
  * One habit: a failure is either named where its owner lives, or it is visible. Every question is answered by TYPE and by
  * the owner that declares the type (BE-CONVENTION 1.8, 3.1): no rule here matches a class, receiver or file by its name.
  *
  *   - `catch-must-account` refuses a `catch` (and a promise `.catch`) that swallows. A handler passes when it rethrows,
  *     returns an outcome carrying the caught error, or calls a method on a receiver typed `Logger` from `platform/logging`.
+ *   - `replacement-throw-carries-cause` (R108 `BE_ERROR_CAUSE_DROPPED`) refuses a `throw` that escapes a `catch` (or a
+ *     promise `.catch` handler) and neither rethrows the caught value nor carries it: the replacement capability error
+ *     takes the exact caught value as `cause` (BE-ERROR-4). A value the rule cannot see through (a parameter, a call that
+ *     is handed the caught value) counts as carrying, so a kept cause is never reported.
  *   - `error-home` keeps every error class where its owner is: a class that derives from `DomainError` is declared only in
  *     `errors/<capability>.error.ts` of its own owner, and a class that derives from the built-in `Error` some other way
  *     (`AbstractException`, a framework `HttpException` subclass, a bare `extends Error`) is refused.
@@ -98,6 +103,105 @@ export const catchMustAccount = {
     },
 }
 
+/** The statements of a catch body that escape it: nested functions, nested handlers and guarded `try` blocks are not. */
+const escapingThrows = (body) => {
+    const found = []
+    const visit = (node) => {
+        if (!node || typeof node !== "object" || typeof node.type !== "string") return
+        if (node.type === "FunctionDeclaration" || node.type === "FunctionExpression" || node.type === "ArrowFunctionExpression") return
+        if (node.type === "CatchClause") return
+        if (node.type === "ThrowStatement") found.push(node)
+        if (node.type === "TryStatement") {
+            // a throw of the guarded block lands in the nested handler, which is judged on its own
+            if (!node.handler) visit(node.block)
+            visit(node.finalizer)
+            return
+        }
+        for (const [key, value] of Object.entries(node)) {
+            if (key === "parent" || key === "loc" || key === "range") continue
+            if (Array.isArray(value)) value.forEach(visit)
+            else visit(value)
+        }
+    }
+    body.body.forEach(visit)
+    return found
+}
+
+/** The variable `identifier` names at its position, or null. */
+const variableOf = (sourceCode, identifier) => {
+    for (let scope = sourceCode.getScope(identifier); scope; scope = scope.upper) {
+        const variable = scope.set.get(identifier.name)
+        if (variable) return variable
+    }
+    return null
+}
+
+/**
+ * True when the thrown value carries the caught one: it is the caught binding, it uses it as a value, or it is a variable
+ * whose initializer or an assignment uses it. Anything the rule cannot see through is taken as carrying, so it never
+ * reports a throw that might keep the cause.
+ */
+const throwCarriesCaught = (sourceCode, argument, caught) => {
+    if (carriesCaught(argument, caught)) return true
+    let value = argument
+    while (value.type === "TSAsExpression" || value.type === "TSNonNullExpression" || value.type === "TSTypeAssertion") value = value.expression
+    if (value.type === "Identifier") {
+        const variable = variableOf(sourceCode, value)
+        // an unresolved global or an import cannot carry this catch's value, but a parameter may hold anything
+        if (!variable) return false
+        if (variable.defs.some((def) => def.type === "Parameter")) return true
+        if (variable.defs.some((def) => def.node.type === "VariableDeclarator" && def.node.init && carriesCaught(def.node.init, caught))) return true
+        return variable.references.some((reference) => reference.isWrite() && reference.writeExpr && carriesCaught(reference.writeExpr, caught))
+    }
+    return false
+}
+
+/** A catch that replaces the caught failure passes the caught value on as the replacement's `cause` (BE-ERROR-4). */
+export const replacementThrowCarriesCause = {
+    meta: {
+        type: "problem",
+        docs: { description: "A throw that escapes a catch rethrows the caught value or carries it (as `cause`) in the replacement." },
+        schema: [],
+        messages: {
+            dropped:
+                "This `throw` replaces the caught failure without carrying it, so the stack and the original error are lost. Pass the exact caught value as `cause` of the capability error (`new <C>Error({ code, cause: {{name}} })`) or rethrow it.",
+            unbound:
+                "This `throw` replaces a failure its `catch` never bound, so the original error is lost. Bind it (`catch (error)`) and pass it as `cause` of the capability error, or rethrow it.",
+        },
+    },
+    create(context) {
+        const sourceCode = context.sourceCode || context.getSourceCode()
+        const check = (body, param) => {
+            const caught = param?.type === "Identifier" ? param.name : null
+            for (const statement of escapingThrows(body)) {
+                const argument = statement.argument
+                if (caught === null) {
+                    context.report({ node: statement, messageId: "unbound" })
+                    continue
+                }
+                if (throwCarriesCaught(sourceCode, argument, caught)) continue
+                context.report({ node: statement, messageId: "dropped", data: { name: caught } })
+            }
+        }
+        return {
+            CatchClause(node) {
+                // a destructured binding names parts of the failure, not the failure itself; the rule cannot tell which part is kept
+                if (node.param && node.param.type !== "Identifier") return
+                check(node.body, node.param)
+            },
+            CallExpression(node) {
+                if (node.callee.type !== "MemberExpression" || node.callee.computed) return
+                if (node.callee.property.type !== "Identifier" || node.callee.property.name !== "catch") return
+                const handler = node.arguments[0]
+                if (!handler || (handler.type !== "ArrowFunctionExpression" && handler.type !== "FunctionExpression")) return
+                if (handler.body.type !== "BlockStatement") return
+                if (handler.params[0] && handler.params[0].type !== "Identifier") return
+                check(handler.body, handler.params[0])
+            },
+        }
+    },
+}
+
 /**
  * The test world (slot `be.tests.world`) is the TEST COMPOSITION ROOT and owns no capability folder: its one error class
  * `TestWorldError` lives in `test-world.error.ts` at the world root, which is the world's `errors/<capability>.error.ts`.
@@ -319,6 +423,7 @@ export const errorFamilyShape = {
 /** The rules this law contributes to the plugin. */
 export const rules = {
     "catch-must-account": catchMustAccount,
+    "replacement-throw-carries-cause": replacementThrowCarriesCause,
     "error-home": errorHome,
     "throw-domain-error": throwDomainError,
     "error-family-shape": errorFamilyShape,
@@ -327,6 +432,7 @@ export const rules = {
 /** All start at error: HFS has no baseline, and the migration lanes clear the debt before a repository adopts them. */
 export const recommended = {
     "starci-be/catch-must-account": "error",
+    "starci-be/replacement-throw-carries-cause": "error",
     "starci-be/error-home": "error",
     "starci-be/throw-domain-error": "error",
     "starci-be/error-family-shape": "error",

package/index.mjs

@@ -41,6 +41,7 @@ import { recommended as operationsRecommended, rules as operationsRules } from "
 import { recommended as querySafetyRecommended, rules as querySafetyRules } from "./query-safety.mjs"
 import { recommended as resilienceRecommended, rules as resilienceRules } from "./resilience.mjs"
 import { recommended as schemaAuthorityRecommended, rules as schemaAuthorityRules } from "./schema-authority.mjs"
+import { recommended as serviceDepsRecommended, rules as serviceDepsRules } from "./service-deps.mjs"
 import { recommended as sizeBudgetRecommended, rules as sizeBudgetRules } from "./size-budget.mjs"
 import { recommended as specNoSkipRecommended, rules as specNoSkipRules } from "./spec-no-skip.mjs"
 import { recommended as specQualityRecommended, rules as specQualityRules } from "./spec-quality.mjs"
@@ -81,6 +82,7 @@ const CONTRIBUTIONS = [
     { law: "query-safety", rules: querySafetyRules, recommended: querySafetyRecommended },
     { law: "resilience", rules: resilienceRules, recommended: resilienceRecommended },
     { law: "schema-authority", rules: schemaAuthorityRules, recommended: schemaAuthorityRecommended },
+    { law: "service-deps", rules: serviceDepsRules, recommended: serviceDepsRecommended },
     { law: "size-budget", rules: sizeBudgetRules, recommended: sizeBudgetRecommended },
     { law: "spec-no-skip", rules: specNoSkipRules, recommended: specNoSkipRecommended },
     { law: "spec-quality", rules: specQualityRules, recommended: specQualityRecommended },

package/infra-owner.mjs

@@ -18,9 +18,14 @@
  * compose: specs stay refused and reach infrastructure through `useTestWorld(...)`.
  *
  * `no-framework-logger` (R40) and `no-ambient-clock` (R79) judge Nest `Logger` and `Date`; the table holds neither.
+ *
+ * `http-client-only-in-integrations` holds the port half of the same law: the `HttpClient` port of `platform/http` (found
+ * by the receiver's TYPE) is called only in an `integrations` owner, `platform/http` itself and the test world, so an
+ * identity provider's token or admin endpoint, a mailer API or any other remote is spoken to by one integration only.
  */
 import { hfsOf, inTestWorld } from "./lib/hfs.mjs"
 import { moduleReferences } from "./lib/import-source.mjs"
+import { isOwnedType } from "./lib/ports.mjs"
 
 /** The owner id of a file: the last two segments of its owner root (`platform/http`), or null when no owner holds it. */
 const ownerIdOf = (hfs, filename) => {
@@ -85,12 +90,46 @@ export const infraImportOwner = {
     },
 }
 
+/** The `HttpClient` port of `platform/http`: the one outbound HTTP door, judged by the receiver's TYPE. */
+const isHttpClient = (context, node) => isOwnedType(context, node, { name: "HttpClient", capability: "http", tier: "platform" })
+
+/**
+ * A provider is spoken to only by its integration (BE-INFRA-3): a call on the `HttpClient` port is made only in an
+ * `integrations` owner, in `platform/http` itself and in the test world. A domain service, a feature or another platform
+ * capability that calls an identity provider's token or admin endpoint, a mailer API or any other remote over HTTP holds a
+ * second copy of that provider's protocol, credentials and failure mapping; it calls the integration's public API instead.
+ */
+export const httpClientOnlyInIntegrations = {
+    meta: {
+        type: "problem",
+        docs: { description: "The `HttpClient` port of `platform/http` is called only by an `integrations` owner (and `platform/http`, the test world)." },
+        schema: [],
+        messages: {
+            foreign: "`{{call}}` calls the `HttpClient` port of `platform/http` outside an integration. A provider (identity provider, mailer, payment, another service) is spoken to only by its `integrations/<provider>` client; call that integration's public API here.",
+        },
+    },
+    create(context) {
+        const hfs = hfsOf(context)
+        const file = context.filename
+        if (hfs.tierOf(file) === "integrations" || ownerIdOf(hfs, file) === "platform/http" || inTestWorld(hfs, file)) return {}
+        return {
+            CallExpression(node) {
+                const callee = node.callee
+                if (callee.type !== "MemberExpression" || !isHttpClient(context, callee.object)) return
+                context.report({ node, messageId: "foreign", data: { call: context.sourceCode.getText(callee) } })
+            },
+        }
+    },
+}
+
 /** The rules this law contributes to the plugin. */
 export const rules = {
     "infra-import-owner": infraImportOwner,
+    "http-client-only-in-integrations": httpClientOnlyInIntegrations,
 }
 
 /** Every rule of this law at `error`. */
 export const recommended = {
     "starci-be/infra-import-owner": "error",
+    "starci-be/http-client-only-in-integrations": "error",
 }

package/input-bounds.mjs

@@ -10,10 +10,15 @@
  *   - `no-offset-pagination` refuses offset paging: `skip`/`offset` in the options of a `find*` on an `EntityManager`,
  *     an `OFFSET` keyword in an `sql` template (or a static string given to `.query`), and `page`/`pageNumber`/`offset`
  *     properties on a transport `dto` class. Pagination is cursor-only: unstable under writes and unbounded in cost otherwise.
+ *   - `auth-door-strict-rate-tier` holds the rate-limit sentence of BE-CONVENTION 1.7: a door opened for
+ *     `PublicReason.AuthHandshake` or `PublicReason.SignedWebhook` (the member of the `PublicReason` enum of
+ *     `domain/identity`, read from the `reason` of the opening decorator by its TYPE) also carries a decorator whose
+ *     argument is `RateTier.Strict` of `platform/http-security`, on the method or on its class. A sign-in, sign-up,
+ *     password-reset or callback door on the default tier is the brute-force path the strict tier exists for.
  */
 import ts from "typescript"
 import { decoratorName, keyName, staticText } from "./lib/ast.mjs"
-import { importsFrom, presentParts, typeOf } from "./lib/declared.mjs"
+import { importsFrom, isOwnedEnumMember, partsOf, presentParts, typeOf } from "./lib/declared.mjs"
 import { hfsOf } from "./lib/hfs.mjs"
 import { normalizePath } from "./lib/path.mjs"
 import { isPackageType, typed } from "./lib/types.mjs"
@@ -171,14 +176,71 @@ export const noOffsetPagination = {
     },
 }
 
+/** The `PublicReason` members whose doors are the brute-force and forgery paths: they owe the strict tier. */
+const STRICT_REASONS = new Set(["AuthHandshake", "SignedWebhook"])
+
+/** The member names of an enum-typed value, when every part of its type is a member of the owned enum; else []. */
+const ownedMembers = (context, node, enumName, tier, capability) =>
+    isOwnedEnumMember(context, node, enumName, tier, capability) ? partsOf(typeOf(context, node)).map((part) => part.getSymbol()?.name ?? "") : []
+
+/** The arguments of a decorator call (`@X(a, b)`), or [] for a bare `@X`. */
+const argumentsOf = (decorator) => (decorator.expression.type === "CallExpression" ? decorator.expression.arguments : [])
+
+/** The `reason` value of an opening decorator's options object (`@Public({ reason })`), or null. */
+const reasonOf = (decorator) => {
+    const options = argumentsOf(decorator)[0]
+    if (options?.type !== "ObjectExpression") return null
+    const property = options.properties.find((item) => item.type === "Property" && !item.computed && keyName(item.key) === "reason")
+    return property ? property.value : null
+}
+
+/** A door opened for a handshake or a webhook is on the strict rate-limit tier. */
+export const authDoorStrictRateTier = {
+    meta: {
+        type: "problem",
+        docs: { description: "A door opened for `PublicReason.AuthHandshake` or `PublicReason.SignedWebhook` carries `RateTier.Strict` of `platform/http-security`." },
+        schema: [],
+        messages: {
+            strict: "This door is open for `PublicReason.{{reason}}` but is not on the strict rate-limit tier. Add `@RateLimit(RateTier.Strict)` (`RateTier` of `platform/http-security`) to the method or its class: a handshake or webhook door on the default tier is an open brute-force path.",
+        },
+    },
+    create(context) {
+        const isStrict = (decorator) => argumentsOf(decorator).some((argument) => {
+            const members = ownedMembers(context, argument, "RateTier", "platform", "http-security")
+            return members.length > 0 && members.every((name) => name === "Strict")
+        })
+        const judge = (target, enclosing) => {
+            for (const decorator of target.decorators ?? []) {
+                const reason = reasonOf(decorator)
+                if (reason === null) continue
+                const opened = ownedMembers(context, reason, "PublicReason", "domain", "identity").find((name) => STRICT_REASONS.has(name))
+                if (opened === undefined) continue
+                if ([...(target.decorators ?? []), ...(enclosing?.decorators ?? [])].some(isStrict)) continue
+                context.report({ node: decorator, messageId: "strict", data: { reason: opened } })
+            }
+        }
+        return {
+            ClassDeclaration(node) {
+                judge(node, null)
+            },
+            MethodDefinition(node) {
+                const owner = node.parent?.parent
+                judge(node, owner?.type === "ClassDeclaration" || owner?.type === "ClassExpression" ? owner : null)
+            },
+        }
+    },
+}
+
 /** The rules this law contributes to the plugin. */
 export const rules = {
     "input-bounded": inputBounded,
     "no-offset-pagination": noOffsetPagination,
+    "auth-door-strict-rate-tier": authDoorStrictRateTier,
 }
 
-/** Both start at error: no baseline exists, and the repositories' fix lanes clear the debt. */
+/** All start at error: no baseline exists, and the repositories' fix lanes clear the debt. */
 export const recommended = {
     "starci-be/input-bounded": "error",
     "starci-be/no-offset-pagination": "error",
+    "starci-be/auth-door-strict-rate-tier": "error",
 }

package/lib/config.mjs

@@ -59,7 +59,7 @@ export const buildBeConfig = async ({ hfs, plugin, recommended }) => {
     if (!hfs || typeof hfs.slotOf !== "function" || typeof hfs.repoRoot !== "string") {
         throw new Error("starciBeConfig needs { hfs: loadHfs(import.meta.url) } - the rules read the repository's slots through it")
     }
-    if (hfs.profile !== "be") throw new Error(`starciBeConfig lints a back end; hfs.json declares profile ${hfs.profile}`)
+    if (hfs.profile !== "be") throw new Error(`starciBeConfig lints the be side of an app (its eslint.config.mjs lives in be/); this view is ${hfs.side ? `the ${hfs.side} side` : "the app root"}`)
     const rules = recommended ?? {}
     if (!plugin?.rules) throw new Error("starciBeConfig needs the canon plugin")
     if (Object.keys(rules).length === 0) throw new Error("starciBeConfig received an empty recommendation - a config with no rules is not adoption")

package/lib/hfs.mjs

@@ -2,7 +2,8 @@
  * The one door between the lint rules and the HFS slot manifest of the repository being linted.
  *
  * A consuming `eslint.config.mjs` is the one line `export default starciBeConfig({ hfs: loadHfs(import.meta.url) })`.
- * `loadHfs` reads the repository's `hfs.json` beside that config file and the slot manifest this package ships in
+ * The config lives in the be/ side folder of an app; `loadHfs` finds the app-root `hfs.json` one level up and gives every file
+ * linted under that folder the view of the be side (paths relative to be/), with the slot manifest this package ships in
  * `runtime/` (a byte copy of the runtime's `knowledge/hfs/slots.yaml`, `scripts/lib/hfs-slots.mjs` and `scripts/lib/hfs-view.mjs`, refreshed by
  * `packages/hfs/scripts/sync-runtime.mjs`), and returns an object the factory puts in `settings.starci.hfs`.
  *
@@ -17,7 +18,7 @@ import { declaredHfsView, openHfsView } from "../runtime/scripts/lib/hfs-view.mj
 const RUNTIME = join(dirname(fileURLToPath(import.meta.url)), "..", "runtime")
 
 /**
- * The HFS view of the repository whose `eslint.config.mjs` calls this.
+ * The HFS view of the side whose `eslint.config.mjs` (in be/) calls this.
  *
  * @param {string} configUrl - `import.meta.url` of the repository's `eslint.config.mjs`.
  * @returns {object} The frozen HFS view (profile, apps, connections, ruleParams, slotOf, tierOf, ownerOf).
@@ -25,13 +26,13 @@ const RUNTIME = join(dirname(fileURLToPath(import.meta.url)), "..", "runtime")
 export const loadHfs = (configUrl) => openHfsView({ runtimeRoot: RUNTIME, repoRoot: dirname(fileURLToPath(configUrl)) })
 
 /**
- * The HFS view of an in-memory declaration, for rule tests: no file is read except the shipped manifest.
+ * The HFS view of the be side of an in-memory app declaration, for rule tests: no file is read except the shipped manifest.
  *
- * @param {object} declaration - An `hfs.json` object.
- * @param {string} repoRoot - The absolute root the linted filenames live under.
+ * @param {object} declaration - An app `hfs.json` object.
+ * @param {string} repoRoot - The absolute be side folder the linted filenames live under.
  * @returns {object} The frozen HFS view.
  */
-export const hfsFromDeclaration = (declaration, repoRoot) => declaredHfsView({ runtimeRoot: RUNTIME, declaration, repoRoot })
+export const hfsFromDeclaration = (declaration, repoRoot) => declaredHfsView({ runtimeRoot: RUNTIME, declaration, repoRoot, side: "be" })
 
 /**
  * The HFS view a rule runs under; a rule that needs it and gets none refuses to guess.

package/lib/persistence.mjs

@@ -113,6 +113,24 @@ export const connectionFileOf = (hfs, file, role) => {
     return connectionsOf(hfs).find((connection) => connection.name === name) ?? null
 }
 
+/** The platform capabilities that own a `persistence/` and so may hold an `EntityManager`. */
+const PERSISTENCE_CAPABILITIES = ["database", "inbox", "outbox", "lease"]
+
+/**
+ * Whether a class in this file may receive an `EntityManager`: an application handler, a domain service, a platform persistence capability.
+ *
+ * @param {object} hfs - The HFS view of the repository.
+ * @param {string} file - A file path.
+ * @returns {boolean} True for the EntityManager-using service roles.
+ */
+export const mayHoldEntityManager = (hfs, file) => {
+    const found = hfs.classify(file)
+    const base = baseNameOf(file)
+    if (found.slot === "be.feature.application") return base.endsWith(".handler.ts")
+    if (found.slot === "be.domain") return base.endsWith(".service.ts")
+    return found.slot === "be.platform" && PERSISTENCE_CAPABILITIES.includes(found.bindings?.capability)
+}
+
 /**
  * The `typeorm` infrastructure type of a node (`EntityManager`, `DataSource`, `QueryRunner`), by type and not by name.
  *
@@ -125,6 +143,17 @@ export const infraTypeOf = (context, node) => {
     return origin ? origin.name : null
 }
 
+/**
+ * Whether a class is a TypeORM migration: it implements the `MigrationInterface` typeorm declares. A migration receives a
+ * `QueryRunner` by contract, wherever the file sits (a fixture migration is one too).
+ *
+ * @param {object} context - The ESLint rule context.
+ * @param {object} classNode - A ClassDeclaration or ClassExpression.
+ * @returns {boolean} True when the class implements typeorm's `MigrationInterface`.
+ */
+export const implementsMigration = (context, classNode) =>
+    (classNode.implements ?? []).some((entry) => typeOrigins(context, entry).some((origin) => origin.module === "typeorm" && origin.name === "MigrationInterface"))
+
 /** The decorator names written on a node: `@Foo()` and `@Foo` both give `Foo`. */
 const decoratorNamesOf = (node) =>
     (node.decorators ?? []).flatMap((decorator) => {