@sun-asterisk/sunlint 1.3.16 → 1.3.17

package/rules/common/C033_separate_service_repository/symbol-based-analyzer.js

@@ -1,29 +1,52 @@
 /**
- * Symbol-based analyzer for C033 - Advanced semantic analysis
- * Purpose: Use AST + Data Flow to detect true database access violations
+ * C033 Symbol-Based Analyzer
+ * Detect Service-Repository separation violations
  */
 
 class C033SymbolBasedAnalyzer {
   constructor(semanticEngine = null) {
     this.ruleId = 'C033';
-    this.ruleName = 'Separate Service and Repository Logic (Symbol-Based)';
     this.semanticEngine = semanticEngine;
     this.verbose = false;
     
-    // Known database/ORM symbols and interfaces
-    this.databaseSymbols = [
-      'Repository', 'EntityManager', 'QueryBuilder', 'Connection',
-      'PrismaClient', 'Model', 'Collection', 'Table'
+    // Database operation patterns (specific to avoid false positives)
+    this.databaseOperations = [
+      // ORM-specific methods
+      'findOne', 'findById', 'findBy', 'findOneBy', 'findAndCount', 'findByIds',
+      'createQueryBuilder', 'getRepository', 'getManager', 'getConnection',
+      // CRUD operations
+      'save', 'insert', 'upsert', 'persist',
+      'update', 'patch', 'merge',
+      'delete', 'remove', 'softDelete', 'destroy',
+      // Query execution
+      'query', 'exec', 'execute', 'run', 'rawQuery',
+      // Specific ORM methods
+      'flush', 'clear', 'refresh', 'reload',
+      // SQL builder methods
+      'select', 'from', 'where', 'innerJoin', 'leftJoin', 'rightJoin',
+      'orderBy', 'groupBy', 'having', 'limit', 'offset',
+      // Transaction methods
+      'beginTransaction', 'commit', 'rollback', 'transaction'
     ];
     
-    // ORM framework patterns
-    this.ormPatterns = {
-      typeorm: ['Repository', 'EntityManager', 'QueryRunner', 'QueryBuilder'],
-      prisma: ['PrismaClient', 'PrismaService'],
-      mongoose: ['Model', 'Document', 'Schema'],
-      sequelize: ['Model', 'Sequelize', 'QueryInterface'],
-      knex: ['Knex', 'QueryBuilder']
-    };
+    // Business logic indicators (should not be in Repository)
+    this.businessLogicPatterns = [
+      'calculate', 'compute', 'process', 'transform', 'convert',
+      'validate', 'verify', 'check', 'ensure', 'confirm',
+      'format', 'parse', 'serialize', 'deserialize',
+      'notify', 'send', 'publish', 'trigger', 'handle', 'execute',
+      'apply', 'enforce', 'implement'
+    ];
+    
+    // ORM framework indicators
+    this.ormFrameworks = [
+      'Repository', 'EntityManager', 'EntityRepository',
+      'PrismaClient', 'PrismaService',
+      'Model', 'Document', 'Schema',
+      'Sequelize', 'QueryInterface',
+      'Knex', 'QueryBuilder',
+      'Connection', 'DataSource'
+    ];
   }
 
   async initialize(semanticEngine = null) {
@@ -31,31 +54,14 @@ class C033SymbolBasedAnalyzer {
       this.semanticEngine = semanticEngine;
     }
     this.verbose = semanticEngine?.verbose || false;
-    
-    if (this.verbose) {
-      console.log(`[DEBUG] 🔧 C033 Symbol-Based: Analyzer initialized`);
-    }
   }
 
   async analyze(files, language, options = {}) {
     const violations = [];
     
-    if (!this.semanticEngine?.project) {
-      if (this.verbose) {
-        console.warn('[C033 Symbol-Based] No semantic engine available, skipping analysis');
-      }
-      return violations;
-    }
-    
     for (const filePath of files) {
-      try {
-        const fileViolations = await this.analyzeFileWithSymbols(filePath, options);
-        violations.push(...fileViolations);
-      } catch (error) {
-        if (this.verbose) {
-          console.warn(`[C033 Symbol-Based] Analysis failed for ${filePath}:`, error.message);
-        }
-      }
+      const fileViolations = await this.analyzeFileWithSymbols(filePath, options);
+      violations.push(...fileViolations);
     }
     
     return violations;
@@ -63,305 +69,442 @@ class C033SymbolBasedAnalyzer {
 
   async analyzeFileWithSymbols(filePath, options = {}) {
     const violations = [];
-    const sourceFile = this.semanticEngine.project.getSourceFileByFilePath(filePath);
     
-    if (!sourceFile) {
-      return violations;
-    }
+    try {
+      if (!this.semanticEngine?.project) {
+        return violations;
+      }
 
-    // 1. Classify file type using semantic analysis
-    const fileType = this.classifyFileSemanticType(sourceFile, filePath);
-    
-    if (fileType !== 'service') {
-      return violations; // Only analyze Service files
-    }
+      const sourceFile = this.semanticEngine.project.getSourceFile(filePath);
+      if (!sourceFile) {
+        return violations;
+      }
 
-    // 2. Analyze call expressions in Service classes
-    const classes = sourceFile.getClasses();
-    
-    for (const cls of classes) {
-      const className = cls.getName() || 'UnknownClass';
+      // Determine file type
+      const fileType = this.determineFileType(filePath, sourceFile);
       
-      // Skip if not a Service class
-      if (!this.isServiceClass(cls)) {
-        continue;
+      if (this.verbose) {
+        console.log(`[C033] Analyzing ${filePath} as ${fileType}`);
       }
-      
-      const methods = cls.getMethods();
-      
-      for (const method of methods) {
-        const methodViolations = this.analyzeMethodForDatabaseCalls(
-          method, sourceFile, className, filePath
-        );
-        violations.push(...methodViolations);
+
+      // Analyze based on file type
+      if (fileType === 'service') {
+        violations.push(...this.analyzeServiceFile(sourceFile, filePath));
+      } else if (fileType === 'repository') {
+        violations.push(...this.analyzeRepositoryFile(sourceFile, filePath));
+      } else if (fileType === 'controller') {
+        violations.push(...this.analyzeControllerFile(sourceFile, filePath));
+      } else if (fileType === 'mixed') {
+        // Add file-level violation for mixing concerns
+        violations.push({
+          ruleId: this.ruleId,
+          severity: 'warning',
+          message: 'Service and Repository classes should be in separate files to maintain clear separation of concerns',
+          file: filePath,
+          line: 1,
+          column: 1
+        });
+        
+        // Also analyze individual Service and Repository classes for additional violations
+        violations.push(...this.analyzeServiceFile(sourceFile, filePath));
+        violations.push(...this.analyzeRepositoryFile(sourceFile, filePath));
+      }
+
+    } catch (error) {
+      if (this.verbose) {
+        console.warn(`[C033] Error analyzing ${filePath}:`, error.message);
       }
     }
-    
+
     return violations;
   }
 
-  /**
-   * Analyze method for direct database calls using symbol resolution
-   */
-  analyzeMethodForDatabaseCalls(method, sourceFile, className, filePath) {
-    const violations = [];
-    const methodName = method.getName();
+  determineFileType(filePath, sourceFile) {
+    // Extract just the filename (not full path) to avoid false positives from directory names
+    const path = require('path');
+    const fileName = path.basename(filePath).toLowerCase();
+    
+    // Check filename patterns
+    if (fileName.includes('service') && fileName.includes('repository')) {
+      if (this.verbose) {
+        console.log(`[C033-DEBUG] File ${fileName} detected as MIXED (filename has both service and repository)`);
+      }
+      return 'mixed';
+    }
+    if (fileName.includes('service')) {
+      if (this.verbose) {
+        console.log(`[C033-DEBUG] File ${fileName} detected as SERVICE (filename)`);
+      }
+      return 'service';
+    }
+    if (fileName.includes('repository')) {
+      if (this.verbose) {
+        console.log(`[C033-DEBUG] File ${fileName} detected as REPOSITORY (filename)`);
+      }
+      return 'repository';
+    }
+    if (fileName.includes('controller')) {
+      if (this.verbose) {
+        console.log(`[C033-DEBUG] File ${fileName} detected as CONTROLLER (filename)`);
+      }
+      return 'controller';
+    }
+    
+    // Check class names in content
+    const classes = sourceFile.getClasses();
+    if (classes.length === 0) {
+      if (this.verbose) {
+        console.log(`[C033-DEBUG] File ${filePath} has no classes - UNKNOWN`);
+      }
+      return 'unknown';
+    }
     
-    // Get all call expressions in the method
-    const callExpressions = method.getDescendantsOfKind(this.getKind('CallExpression'));
+    const classNames = classes.map(cls => cls.getName() || 'Unnamed').join(', ');
+    const hasService = classes.some(cls => cls.getName()?.toLowerCase().includes('service'));
+    const hasRepository = classes.some(cls => cls.getName()?.toLowerCase().includes('repository'));
     
-    for (const callExpr of callExpressions) {
-      const violation = this.analyzeCallExpression(callExpr, sourceFile, className, methodName, filePath);
-      if (violation) {
-        violations.push(violation);
+    if (this.verbose) {
+      console.log(`[C033-DEBUG] File ${filePath} has classes: [${classNames}]`);
+      console.log(`[C033-DEBUG] hasService=${hasService}, hasRepository=${hasRepository}`);
+    }
+    
+    if (hasService && hasRepository) {
+      if (this.verbose) {
+        console.log(`[C033-DEBUG] File ${filePath} detected as MIXED (has both Service and Repository classes)`);
+      }
+      return 'mixed';
+    }
+    if (hasService) {
+      if (this.verbose) {
+        console.log(`[C033-DEBUG] File ${filePath} detected as SERVICE (class name)`);
+      }
+      return 'service';
+    }
+    if (hasRepository) {
+      if (this.verbose) {
+        console.log(`[C033-DEBUG] File ${filePath} detected as REPOSITORY (class name)`);
       }
+      return 'repository';
     }
     
-    return violations;
+    if (this.verbose) {
+      console.log(`[C033-DEBUG] File ${filePath} detected as UNKNOWN`);
+    }
+    return 'unknown';
   }
 
-  /**
-   * Analyze individual call expression using symbol resolution
-   */
-  analyzeCallExpression(callExpr, sourceFile, className, methodName, filePath) {
-    const expression = callExpr.getExpression();
+  analyzeServiceFile(sourceFile, filePath) {
+    const violations = [];
+    const classes = sourceFile.getClasses();
     
-    // Handle property access (obj.method())
-    if (expression.getKind() === this.getKind('PropertyAccessExpression')) {
-      const propertyAccess = expression;
-      const object = propertyAccess.getExpression();
-      const property = propertyAccess.getName();
+    for (const cls of classes) {
+      const className = cls.getName() || 'UnnamedClass';
       
-      // Get the symbol/type of the object being called
-      const objectSymbol = this.getObjectSymbol(object);
+      // Skip if this is a Repository class (in mixed files)
+      if (className.toLowerCase().includes('repository')) {
+        continue;
+      }
       
-      if (this.isDatabaseOperation(objectSymbol, property)) {
-        // Check if it's going through repository (acceptable)
-        if (this.isRepositoryAccess(objectSymbol)) {
-          return null; // OK: Service -> Repository -> Database
-        }
-        
-        // Direct database access in Service (violation)
-        const lineNumber = callExpr.getStartLineNumber();
-        const columnNumber = callExpr.getStart() - sourceFile.getLineStartPos(lineNumber - 1) + 1;
-        
-        return {
+      // Check if Service uses dependency injection for Repository
+      const hasRepositoryInjection = this.checkRepositoryInjection(cls);
+      const hasDirectDbAccess = this.checkDirectDatabaseAccess(cls);
+      
+      if (hasDirectDbAccess && !hasRepositoryInjection) {
+        violations.push({
           ruleId: this.ruleId,
           severity: 'warning',
-          message: `Service should not contain direct database calls`,
-          source: this.ruleId,
+          message: `Service class '${className}' should use dependency injection to inject Repository instead of direct database access.`,
           file: filePath,
-          line: lineNumber,
-          column: columnNumber,
-          description: `[SYMBOL-BASED] Direct database call '${property}()' on '${objectSymbol?.name || 'unknown'}' found in Service`,
-          suggestion: 'Use Repository pattern for data access',
-          category: 'architecture'
-        };
+          line: cls.getStartLineNumber(),
+          column: 1
+        });
+      }
+      
+      const methods = cls.getMethods();
+      
+      for (const method of methods) {
+        // Check for direct database operations in Service (not via repository)
+        const methodBody = method.getBodyText() || '';
+        
+        // Check for direct database access patterns
+        const directDbPatterns = [
+          // Direct access to dataSource/connection
+          /this\.(dataSource|connection|entityManager|manager)\s*\.\s*createQueryBuilder/i,
+          /this\.(dataSource|connection|entityManager|manager)\s*\.\s*getRepository/i,
+          /this\.(dataSource|connection|entityManager|manager)\s*\.\s*query/i,
+          
+          // Global getRepository/getConnection calls
+          /(?<!this\.[\w]+Repository\.)getRepository\s*\(/i,
+          /getConnection\s*\(/i,
+          /getManager\s*\(/i,
+          
+          // createQueryBuilder on dataSource (not repository)
+          /this\.(dataSource|connection|db|database)\s*\.\s*createQueryBuilder/i,
+        ];
+        
+        let hasDirectDbAccess = false;
+        let detectedOperation = '';
+        
+        for (const pattern of directDbPatterns) {
+          if (pattern.test(methodBody)) {
+            hasDirectDbAccess = true;
+            
+            // Extract operation name for better error message
+            const match = methodBody.match(pattern);
+            if (match) {
+              detectedOperation = match[0].replace(/this\./g, '').replace(/\s/g, '');
+            }
+            break;
+          }
+        }
+        
+        // Also check database operations list
+        if (!hasDirectDbAccess) {
+          for (const operation of this.databaseOperations) {
+            const pattern = new RegExp(`\\b${operation}\\s*\\(`, 'i');
+            if (pattern.test(methodBody)) {
+              // Check if this is truly direct DB call (not via repository)
+              const dbObjectPattern = /this\.(dataSource|connection|entityManager|manager|database|db)\./i;
+              const globalCallPattern = /\b(getRepository|getConnection|getManager|createQueryBuilder)\s*\(/i;
+              
+              if (dbObjectPattern.test(methodBody) || globalCallPattern.test(methodBody)) {
+                hasDirectDbAccess = true;
+                detectedOperation = operation;
+                break;
+              }
+            }
+          }
+        }
+        
+        if (hasDirectDbAccess) {
+          violations.push({
+            ruleId: this.ruleId,
+            severity: 'warning',
+            message: `Service method '${method.getName()}' directly calls database operation '${detectedOperation}'. Consider using Repository pattern to separate data access logic.`,
+            file: filePath,
+            line: method.getStartLineNumber(),
+            column: 1
+          });
+        }
       }
     }
     
-    return null;
+    return violations;
   }
 
-  /**
-   * Get symbol information for an object expression
-   */
-  getObjectSymbol(objectExpr) {
+  checkRepositoryInjection(cls) {
     try {
-      // Try to get the symbol of the expression
-      const symbol = objectExpr.getSymbol();
-      if (symbol) {
-        return {
-          name: symbol.getName(),
-          type: this.getSymbolType(symbol),
-          isDatabase: this.isSymbolDatabase(symbol)
-        };
+      // Check constructor parameters
+      const constructor = cls.getConstructors()[0];
+      if (constructor) {
+        const params = constructor.getParameters();
+        for (const param of params) {
+          const paramName = param.getName().toLowerCase();
+          const paramType = param.getType().getText().toLowerCase();
+          
+          if (paramName.includes('repository') || 
+              paramName.includes('repo') ||
+              paramType.includes('repository')) {
+            return true;
+          }
+        }
       }
       
-      // Fallback: analyze by text patterns
-      const text = objectExpr.getText();
-      return {
-        name: text,
-        type: this.inferTypeFromText(text),
-        isDatabase: this.isTextDatabase(text)
-      };
+      // Check class properties
+      const properties = cls.getProperties();
+      for (const prop of properties) {
+        const propName = prop.getName().toLowerCase();
+        const propType = prop.getType().getText().toLowerCase();
+        
+        if (propName.includes('repository') || 
+            propName.includes('repo') ||
+            propType.includes('repository')) {
+          return true;
+        }
+      }
     } catch (error) {
-      return null;
+      // Ignore errors
     }
+    
+    return false;
   }
 
-  /**
-   * Check if operation is a database operation
-   */
-  isDatabaseOperation(objectSymbol, methodName) {
-    if (!objectSymbol) return false;
-    
-    // Exclude queue/job operations (Bull.js, agenda, etc.)
-    if (this.isQueueOperation(objectSymbol, methodName)) {
-      return false;
+  checkDirectDatabaseAccess(cls) {
+    try {
+      const classText = cls.getText();
+      
+      // Check for ORM framework usage
+      for (const framework of this.ormFrameworks) {
+        if (classText.includes(framework)) {
+          return true;
+        }
+      }
+      
+      // Check for database operations
+      for (const operation of this.databaseOperations) {
+        const pattern = new RegExp(`\\b${operation}\\s*\\(`, 'i');
+        if (pattern.test(classText)) {
+          return true;
+        }
+      }
+    } catch (error) {
+      // Ignore errors
     }
     
-    // Known database method patterns
-    const dbMethods = [
-      'findOneBy', 'findBy', 'findAndCount', 'findMany', 'findFirst',
-      'save', 'insert', 'create', 'upsert',
-      'update', 'patch', 'merge', 'set',
-      'delete', 'remove', 'destroy',
-      'query', 'execute', 'run',
-      'createQueryBuilder', 'getRepository'
-    ];
-    
-    return objectSymbol.isDatabase && dbMethods.includes(methodName);
+    return false;
   }
 
-  /**
-   * Check if this is a queue/job operation (should be excluded)
-   */
-  isQueueOperation(objectSymbol, methodName) {
-    if (!objectSymbol) return false;
-    
-    const queueMethods = [
-      'remove', 'isFailed', 'isCompleted', 'isActive', 'isWaiting', 'isDelayed',
-      'getJob', 'getJobs', 'add', 'process', 'on', 'off',
-      'retry', 'moveToCompleted', 'moveToFailed'
-    ];
-    
-    const queueTypes = ['queue', 'job', 'bull'];
-    const objectName = objectSymbol.name.toLowerCase();
-    
-    // Enhanced detection for Bull.js Job objects
-    const isQueueMethod = queueMethods.includes(methodName);
-    const isQueueObject = queueTypes.some(type => objectName.includes(type)) ||
-                          /job/i.test(objectName) || 
-                          /queue/i.test(objectName);
+  analyzeRepositoryFile(sourceFile, filePath) {
+    const violations = [];
+    const classes = sourceFile.getClasses();
     
-    if (this.verbose && (isQueueMethod || isQueueObject)) {
-      console.log(`[DEBUG] Queue Check: object="${objectName}", method="${methodName}", isQueue=${isQueueMethod && isQueueObject}`);
+    for (const cls of classes) {
+      const className = cls.getName() || 'UnnamedClass';
+      
+      // Skip if this is a Service class (in mixed files)
+      if (className.toLowerCase().includes('service') && !className.toLowerCase().includes('repository')) {
+        continue;
+      }
+      
+      const methods = cls.getMethods();
+      
+      // Check if Repository follows CRUD pattern
+      const hasCrudMethods = this.checkCrudPattern(cls);
+      const hasBusinessLogic = this.checkBusinessLogicInRepository(cls);
+      
+      if (hasBusinessLogic) {
+        violations.push({
+          ruleId: this.ruleId,
+          severity: 'warning',
+          message: `Repository class '${className}' should contain only CRUD operations. Business logic detected - move to Service layer.`,
+          file: filePath,
+          line: cls.getStartLineNumber(),
+          column: 1
+        });
+      }
+      
+      for (const method of methods) {
+        const methodName = method.getName();
+        
+        // Check method name for business logic indicators
+        for (const pattern of this.businessLogicPatterns) {
+          if (methodName.toLowerCase().includes(pattern.toLowerCase())) {
+            violations.push({
+              ruleId: this.ruleId,
+              severity: 'warning',
+              message: `Repository method '${methodName}' in class '${className}' appears to contain business logic ('${pattern}'). Move business logic to Service layer.`,
+              file: filePath,
+              line: method.getStartLineNumber(),
+              column: 1
+            });
+            break;
+          }
+        }
+        
+        // Check method complexity (too many control structures = business logic)
+        const methodBody = method.getBodyText() || '';
+        const ifCount = (methodBody.match(/\bif\s*\(/g) || []).length;
+        const forCount = (methodBody.match(/\bfor\s*\(/g) || []).length;
+        const whileCount = (methodBody.match(/\bwhile\s*\(/g) || []).length;
+        const complexityCount = ifCount + forCount + whileCount;
+        
+        if (complexityCount > 2) {
+          violations.push({
+            ruleId: this.ruleId,
+            severity: 'warning',
+            message: `Repository method '${methodName}' is too complex (${complexityCount} control structures). Repository should contain only simple data access operations.`,
+            file: filePath,
+            line: method.getStartLineNumber(),
+            column: 1
+          });
+        }
+        
+        // Check for business logic in method body
+        const hasCalculation = /\b(calculate|compute|sum|total|average)\b/i.test(methodBody);
+        const hasValidation = /\b(validate|verify|check|ensure|confirm)\b/i.test(methodBody);
+        const hasTransformation = /\b(transform|convert|format|parse)\b/i.test(methodBody);
+        
+        if ((hasCalculation || hasValidation || hasTransformation) && complexityCount > 0) {
+          violations.push({
+            ruleId: this.ruleId,
+            severity: 'warning',
+            message: `Repository method '${methodName}' contains business logic operations. Repository should focus on data access only.`,
+            file: filePath,
+            line: method.getStartLineNumber(),
+            column: 1
+          });
+        }
+      }
     }
     
-    return isQueueMethod && isQueueObject;
-  }
-
-  /**
-   * Check if access is through repository (acceptable)
-   */
-  isRepositoryAccess(objectSymbol) {
-    if (!objectSymbol) return false;
-    
-    const name = objectSymbol.name.toLowerCase();
-    return name.includes('repository') || name.includes('repo');
+    return violations;
   }
 
-  /**
-   * Check if symbol represents database object
-   */
-  isSymbolDatabase(symbol) {
+  checkCrudPattern(cls) {
     try {
-      const type = symbol.getType();
-      const typeName = type.getSymbol()?.getName() || '';
+      const methods = cls.getMethods();
+      const methodNames = methods.map(m => m.getName().toLowerCase());
+      
+      // Check for basic CRUD operations
+      const hasCreate = methodNames.some(name => name.includes('create') || name.includes('save') || name.includes('insert'));
+      const hasRead = methodNames.some(name => name.includes('find') || name.includes('get') || name.includes('select'));
+      const hasUpdate = methodNames.some(name => name.includes('update') || name.includes('patch'));
+      const hasDelete = methodNames.some(name => name.includes('delete') || name.includes('remove'));
       
-      return this.databaseSymbols.some(dbSymbol => 
-        typeName.includes(dbSymbol)
-      );
+      return hasCreate || hasRead || hasUpdate || hasDelete;
     } catch (error) {
       return false;
     }
   }
 
-  /**
-   * Infer type from text patterns (fallback)
-   */
-  inferTypeFromText(text) {
-    const lowerText = text.toLowerCase();
-    
-    // Check for known database object patterns
-    if (/manager|connection|client|prisma/i.test(lowerText)) {
-      return 'database';
-    }
-    
-    if (/repository|repo/i.test(lowerText)) {
-      return 'repository';
+  checkBusinessLogicInRepository(cls) {
+    try {
+      const classText = cls.getText();
+      
+      // Check for business logic patterns
+      for (const pattern of this.businessLogicPatterns) {
+        const regex = new RegExp(`\\b${pattern}\\w*\\s*\\(`, 'i');
+        if (regex.test(classText)) {
+          return true;
+        }
+      }
+    } catch (error) {
+      // Ignore errors
     }
     
-    return 'unknown';
-  }
-
-  /**
-   * Check if text represents database access
-   */
-  isTextDatabase(text) {
-    const lowerText = text.toLowerCase();
-    return /manager|connection|client|prisma|entitymanager/i.test(lowerText) &&
-           !/repository|repo/i.test(lowerText);
+    return false;
   }
 
-  /**
-   * Classify file type using semantic analysis
-   */
-  classifyFileSemanticType(sourceFile, filePath) {
-    const fileName = sourceFile.getBaseName().toLowerCase();
-    
-    // Check filename patterns
-    if (/service\.ts$|service\.js$/i.test(fileName)) return 'service';
-    if (/repository\.ts$|repository\.js$/i.test(fileName)) return 'repository';
-    
-    // Check class patterns
+  analyzeControllerFile(sourceFile, filePath) {
+    const violations = [];
     const classes = sourceFile.getClasses();
+    
     for (const cls of classes) {
-      if (this.isServiceClass(cls)) return 'service';
-      if (this.isRepositoryClass(cls)) return 'repository';
+      const className = cls.getName() || 'UnnamedClass';
+      const methods = cls.getMethods();
+      
+      for (const method of methods) {
+        const methodBody = method.getBodyText() || '';
+        
+        // Controllers should not directly access database
+        for (const operation of this.databaseOperations) {
+          const pattern = new RegExp(`\\b${operation}\\s*\\(`, 'i');
+          if (pattern.test(methodBody)) {
+            violations.push({
+              ruleId: this.ruleId,
+              severity: 'warning',
+              message: `Controller class '${className}' should not directly access database with '${operation}'. Use Service layer instead.`,
+              file: filePath,
+              line: method.getStartLineNumber(),
+              column: 1
+            });
+            break;
+          }
+        }
+      }
     }
     
-    return 'unknown';
-  }
-
-  /**
-   * Check if class is a Service class
-   */
-  isServiceClass(cls) {
-    const className = cls.getName()?.toLowerCase() || '';
-    
-    // Check class name
-    if (/service$/.test(className)) return true;
-    
-    // Check decorators
-    const decorators = cls.getDecorators();
-    return decorators.some(decorator => {
-      const decoratorName = decorator.getName().toLowerCase();
-      return decoratorName.includes('service') || decoratorName === 'injectable';
-    });
-  }
-
-  /**
-   * Check if class is a Repository class
-   */
-  isRepositoryClass(cls) {
-    const className = cls.getName()?.toLowerCase() || '';
-    return /repository$|repo$/.test(className);
-  }
-
-  /**
-   * Get TypeScript SyntaxKind
-   */
-  getKind(kindName) {
-    try {
-      const ts = require('typescript');
-      return ts.SyntaxKind[kindName];
-    } catch (error) {
-      // Fallback for ts-morph
-      return this.semanticEngine?.project?.getTypeChecker()?.compilerObject?.SyntaxKind?.[kindName] || 0;
-    }
-  }
-
-  /**
-   * Get symbol type information
-   */
-  getSymbolType(symbol) {
-    try {
-      return symbol.getType().getText();
-    } catch (error) {
-      return 'unknown';
-    }
+    return violations;
   }
 }