@sun-asterisk/sunlint 1.3.23 → 1.3.25

package/rules/common/C033_separate_service_repository/symbol-based-analyzer.js

@@ -9,44 +9,91 @@ class C033SymbolBasedAnalyzer {
     this.semanticEngine = semanticEngine;
     this.verbose = false;
     
-    // Database operation patterns (specific to avoid false positives)
+    // ============================================================
+    // PATTERN DEFINITIONS - Organized by category
+    // ============================================================
+    
+    // Database CRUD operations (TypeORM, Prisma, Sequelize, etc.)
     this.databaseOperations = [
-      // ORM-specific methods
+      // Query operations
       'findOne', 'findById', 'findBy', 'findOneBy', 'findAndCount', 'findByIds',
-      'createQueryBuilder', 'getRepository', 'getManager', 'getConnection',
-      // CRUD operations
-      'save', 'insert', 'upsert', 'persist',
-      'update', 'patch', 'merge',
-      'delete', 'remove', 'softDelete', 'destroy',
+      'find', 'findMany', 'findAll', 'findFirst', 'get', 'getMany', 'getOne',
+      // Create operations
+      'save', 'insert', 'upsert', 'persist', 'create', 'createMany',
+      // Update operations
+      'update', 'patch', 'merge', 'updateMany', 'set',
+      // Delete operations
+      'delete', 'remove', 'softDelete', 'destroy', 'deleteMany',
       // Query execution
-      'query', 'exec', 'execute', 'run', 'rawQuery',
-      // Specific ORM methods
-      'flush', 'clear', 'refresh', 'reload',
-      // SQL builder methods
-      'select', 'from', 'where', 'innerJoin', 'leftJoin', 'rightJoin',
-      'orderBy', 'groupBy', 'having', 'limit', 'offset',
-      // Transaction methods
-      'beginTransaction', 'commit', 'rollback', 'transaction'
+      'query', 'exec', 'execute', 'run', 'rawQuery', 'raw',
+      // ORM-specific
+      'flush', 'clear', 'refresh', 'reload', 'count', 'aggregate'
     ];
     
-    // Business logic indicators (should not be in Repository)
-    this.businessLogicPatterns = [
-      'calculate', 'compute', 'process', 'transform', 'convert',
-      'validate', 'verify', 'check', 'ensure', 'confirm',
-      'format', 'parse', 'serialize', 'deserialize',
-      'notify', 'send', 'publish', 'trigger', 'handle', 'execute',
-      'apply', 'enforce', 'implement'
+    // Query builder methods
+    this.queryBuilderMethods = [
+      'createQueryBuilder', 'queryBuilder',
+      'select', 'from', 'where', 'andWhere', 'orWhere',
+      'innerJoin', 'leftJoin', 'rightJoin', 'join',
+      'orderBy', 'groupBy', 'having', 'limit', 'offset', 'skip', 'take',
+      'getMany', 'getOne', 'getRawMany', 'getRawOne', 'getCount'
     ];
     
-    // ORM framework indicators
+    // Transaction and connection methods
+    this.transactionMethods = [
+      'transaction', 'beginTransaction', 'commit', 'rollback',
+      'startTransaction', 'commitTransaction', 'rollbackTransaction',
+      'createQueryRunner', 'getQueryRunner'
+    ];
+    
+    // Schema and migration operations (should rarely be in Service)
+    this.schemaOperations = [
+      'synchronize', 'sync', 'dropDatabase', 'dropSchema',
+      'runMigrations', 'undoLastMigration', 'showMigrations',
+      'createTable', 'dropTable', 'alterTable', 'addColumn', 'dropColumn'
+    ];
+    
+    // Database connection properties
+    // NOTE: Removed generic 'client' to avoid false positives with httpClient, apiClient, etc.
+    // Only specific database clients are included
+    this.databaseProperties = [
+      'dataSource', 'connection', 'entityManager', 'manager',
+      'database', 'db', 
+      // Specific database clients only
+      'prismaClient', 'prismaService',
+      'sequelizeClient', 'sequelizeConnection',
+      'mongoClient', 'mongoConnection',
+      'redisClient', 'redisConnection',
+      'dbClient', 'databaseClient',
+      // ORM instances
+      'prisma', 'sequelize', 'knex', 'mongoose', 'typeorm'
+    ];
+    
+    // ORM framework type indicators
     this.ormFrameworks = [
-      'Repository', 'EntityManager', 'EntityRepository',
+      'Repository', 'EntityRepository', 'EntityManager',
       'PrismaClient', 'PrismaService',
       'Model', 'Document', 'Schema',
       'Sequelize', 'QueryInterface',
       'Knex', 'QueryBuilder',
       'Connection', 'DataSource'
     ];
+    
+    // Business logic indicators (should NOT be in Repository)
+    this.businessLogicPatterns = [
+      // Calculation and computation
+      'calculate', 'compute', 'sum', 'total', 'average', 'aggregate',
+      // Validation and verification
+      'validate', 'verify', 'check', 'ensure', 'confirm', 'assert',
+      // Transformation and conversion
+      'format', 'parse', 'serialize', 'deserialize', 'transform', 'convert',
+      // Business operations
+      'process', 'handle', 'execute', 'perform', 'apply',
+      // Notifications and communications
+      'notify', 'send', 'publish', 'trigger', 'broadcast',
+      // Business rules
+      'enforce', 'implement', 'authorize', 'approve', 'reject'
+    ];
   }
 
   async initialize(semanticEngine = null) {
@@ -56,6 +103,31 @@ class C033SymbolBasedAnalyzer {
     this.verbose = semanticEngine?.verbose || false;
   }
 
+  // ============================================================
+  // HELPER METHODS
+  // ============================================================
+
+  /**
+   * Calculate exact line number from string index
+   * @param {string} text - The method body text
+   * @param {number} index - Index of match in text
+   * @param {number} startLine - Starting line number of method
+   * @returns {number} Exact line number of violation
+   */
+  calculateLineNumberFromIndex(text, index, startLine) {
+    if (index === undefined || index === null) {
+      return startLine; // Fallback to method start line
+    }
+    
+    const textBeforeMatch = text.substring(0, index);
+    const lineOffset = (textBeforeMatch.match(/\n/g) || []).length;
+    
+    // Method body starts after the opening brace, which is typically on the line
+    // after method signature. getBodyText() returns content inside braces.
+    // So we need to add lineOffset without additional adjustment.
+    return startLine + lineOffset;
+  }
+
   async analyze(files, language, options = {}) {
     const violations = [];
     
@@ -193,6 +265,10 @@ class C033SymbolBasedAnalyzer {
     return 'unknown';
   }
 
+  // ============================================================
+  // SERVICE FILE ANALYSIS
+  // ============================================================
+
   analyzeServiceFile(sourceFile, filePath) {
     const violations = [];
     const classes = sourceFile.getClasses();
@@ -205,11 +281,24 @@ class C033SymbolBasedAnalyzer {
         continue;
       }
       
-      // Check if Service uses dependency injection for Repository
+      // Check class-level patterns
       const hasRepositoryInjection = this.checkRepositoryInjection(cls);
-      const hasDirectDbAccess = this.checkDirectDatabaseAccess(cls);
+      const hasDatabaseInjection = this.checkDatabaseInjection(cls);
       
-      if (hasDirectDbAccess && !hasRepositoryInjection) {
+      // VIOLATION: Service has both Repository and direct database access
+      if (hasRepositoryInjection && hasDatabaseInjection) {
+        violations.push({
+          ruleId: this.ruleId,
+          severity: 'warning',
+          message: `Service class '${className}' has both Repository injection and direct database access (DataSource/Connection/EntityManager). This creates inconsistent patterns - use only Repository.`,
+          file: filePath,
+          line: cls.getStartLineNumber(),
+          column: 1
+        });
+      }
+      
+      // VIOLATION: Service has direct database access without Repository
+      if (!hasRepositoryInjection && hasDatabaseInjection) {
         violations.push({
           ruleId: this.ruleId,
           severity: 'warning',
@@ -220,78 +309,223 @@ class C033SymbolBasedAnalyzer {
         });
       }
       
+      // Analyze each method in the service
       const methods = cls.getMethods();
-      
       for (const method of methods) {
-        // Check for direct database operations in Service (not via repository)
-        const methodBody = method.getBodyText() || '';
-        
-        // Check for direct database access patterns
-        const directDbPatterns = [
-          // Direct access to dataSource/connection
-          /this\.(dataSource|connection|entityManager|manager)\s*\.\s*createQueryBuilder/i,
-          /this\.(dataSource|connection|entityManager|manager)\s*\.\s*getRepository/i,
-          /this\.(dataSource|connection|entityManager|manager)\s*\.\s*query/i,
-          
-          // Global getRepository/getConnection calls
-          /(?<!this\.[\w]+Repository\.)getRepository\s*\(/i,
-          /getConnection\s*\(/i,
-          /getManager\s*\(/i,
-          
-          // createQueryBuilder on dataSource (not repository)
-          /this\.(dataSource|connection|db|database)\s*\.\s*createQueryBuilder/i,
-        ];
-        
-        let hasDirectDbAccess = false;
-        let detectedOperation = '';
+        violations.push(...this.analyzeServiceMethod(method, className, filePath));
+      }
+    }
+    
+    return violations;
+  }
+
+  analyzeServiceMethod(method, className, filePath) {
+    const violations = [];
+    const methodName = method.getName();
+    const methodBody = method.getBodyText() || '';
+    
+    // Get the actual body block start line (opening brace)
+    const methodBodyNode = method.getBody();
+    const bodyStartLine = methodBodyNode ? methodBodyNode.getStartLineNumber() + 1 : method.getStartLineNumber();
+    
+    // Check for different types of violations
+    const directDbViolation = this.checkDirectDatabaseAccess_InMethod(methodBody);
+    if (directDbViolation) {
+      const violationLine = this.calculateLineNumberFromIndex(
+        methodBody, 
+        directDbViolation.matchIndex, 
+        bodyStartLine
+      );
+      
+      violations.push({
+        ruleId: this.ruleId,
+        severity: 'warning',
+        message: `Service method '${methodName}' directly calls database operation '${directDbViolation.operation}'. Consider using Repository pattern to separate data access logic.`,
+        file: filePath,
+        line: violationLine,
+        column: 1
+      });
+    }
+    
+    const transactionViolation = this.checkTransactionAccess_InMethod(methodBody);
+    if (transactionViolation) {
+      const violationLine = this.calculateLineNumberFromIndex(
+        methodBody,
+        transactionViolation.matchIndex,
+        bodyStartLine
+      );
+      
+      violations.push({
+        ruleId: this.ruleId,
+        severity: 'warning',
+        message: `Service method '${methodName}' directly handles transactions using '${transactionViolation.operation}'. Consider delegating transaction logic to Repository or a dedicated transaction service.`,
+        file: filePath,
+        line: violationLine,
+        column: 1
+      });
+    }
+    
+    const queryRunnerViolation = this.checkQueryRunnerAccess_InMethod(methodBody);
+    if (queryRunnerViolation) {
+      const violationLine = this.calculateLineNumberFromIndex(
+        methodBody,
+        queryRunnerViolation.matchIndex,
+        bodyStartLine
+      );
+      
+      violations.push({
+        ruleId: this.ruleId,
+        severity: 'warning',
+        message: `Service method '${methodName}' directly uses QueryRunner. QueryRunner operations should be encapsulated in Repository layer.`,
+        file: filePath,
+        line: violationLine,
+        column: 1
+      });
+    }
+    
+    const schemaViolation = this.checkSchemaOperations_InMethod(methodBody);
+    if (schemaViolation) {
+      const violationLine = this.calculateLineNumberFromIndex(
+        methodBody,
+        schemaViolation.matchIndex,
+        bodyStartLine
+      );
+      
+      violations.push({
+        ruleId: this.ruleId,
+        severity: 'error',
+        message: `Service method '${methodName}' performs schema operations ('${schemaViolation.operation}'). Schema operations should not be in Service layer.`,
+        file: filePath,
+        line: violationLine,
+        column: 1
+      });
+    }
+    
+    return violations;
+  }
+
+  // ============================================================
+  // SERVICE METHOD VIOLATION CHECKERS
+  // ============================================================
+
+  checkDirectDatabaseAccess_InMethod(methodBody) {
+    // Pattern 1: Direct access to dataSource/connection/manager
+    const directAccessPatterns = [
+      { regex: /this\.(dataSource|connection|entityManager|manager)\s*\.\s*createQueryBuilder/i, type: 'createQueryBuilder' },
+      { regex: /this\.(dataSource|connection|entityManager|manager)\s*\.\s*getRepository/i, type: 'getRepository' },
+      { regex: /this\.(dataSource|connection|entityManager|manager)\s*\.\s*query/i, type: 'query' },
+    ];
+    
+    for (const pattern of directAccessPatterns) {
+      const match = methodBody.match(pattern.regex);
+      if (match) {
+        return { operation: pattern.type, pattern: 'direct-access', matchIndex: match.index };
+      }
+    }
+    
+    // Pattern 2: Global ORM calls
+    const globalPatterns = [
+      { regex: /(?<!Repository\.)getRepository\s*\(/i, type: 'getRepository' },
+      { regex: /\bgetConnection\s*\(/i, type: 'getConnection' },
+      { regex: /\bgetManager\s*\(/i, type: 'getManager' },
+    ];
+    
+    for (const pattern of globalPatterns) {
+      const match = methodBody.match(pattern.regex);
+      if (match) {
+        return { operation: pattern.type, pattern: 'global-call', matchIndex: match.index };
+      }
+    }
+    
+    // Pattern 3: Database operations with context check
+    for (const operation of this.databaseOperations) {
+      const operationPattern = new RegExp(`\\b${operation}\\s*\\(`, 'gi');
+      const matches = methodBody.matchAll(operationPattern);
+      
+      for (const match of matches) {
+        const matchIndex = match.index;
+        const contextStart = Math.max(0, matchIndex - 50);
+        const context = methodBody.substring(contextStart, matchIndex);
         
-        for (const pattern of directDbPatterns) {
-          if (pattern.test(methodBody)) {
-            hasDirectDbAccess = true;
-            
-            // Extract operation name for better error message
-            const match = methodBody.match(pattern);
-            if (match) {
-              detectedOperation = match[0].replace(/this\./g, '').replace(/\s/g, '');
-            }
-            break;
-          }
+        // Check if this is a call through repository (ALLOWED)
+        const repositoryCallPattern = /this\.([\w]+Repository|[\w]+Repo)\s*\.\s*$/i;
+        if (repositoryCallPattern.test(context)) {
+          continue; // Skip - this is allowed
         }
         
-        // Also check database operations list
-        if (!hasDirectDbAccess) {
-          for (const operation of this.databaseOperations) {
-            const pattern = new RegExp(`\\b${operation}\\s*\\(`, 'i');
-            if (pattern.test(methodBody)) {
-              // Check if this is truly direct DB call (not via repository)
-              const dbObjectPattern = /this\.(dataSource|connection|entityManager|manager|database|db)\./i;
-              const globalCallPattern = /\b(getRepository|getConnection|getManager|createQueryBuilder)\s*\(/i;
-              
-              if (dbObjectPattern.test(methodBody) || globalCallPattern.test(methodBody)) {
-                hasDirectDbAccess = true;
-                detectedOperation = operation;
-                break;
-              }
-            }
-          }
-        }
+        // Check if this is direct database call (VIOLATION)
+        const directDbCallPattern = /this\.(dataSource|connection|entityManager|manager|database|db|client|prisma)\./i;
+        const globalDbCallPattern = /(getRepository|getConnection|getManager|createQueryBuilder)\s*\([^)]*\)\s*\.?[\w.]*$/i;
         
-        if (hasDirectDbAccess) {
-          violations.push({
-            ruleId: this.ruleId,
-            severity: 'warning',
-            message: `Service method '${method.getName()}' directly calls database operation '${detectedOperation}'. Consider using Repository pattern to separate data access logic.`,
-            file: filePath,
-            line: method.getStartLineNumber(),
-            column: 1
-          });
+        if (directDbCallPattern.test(context) || globalDbCallPattern.test(context)) {
+          return { operation, pattern: 'context-detected', matchIndex };
         }
       }
     }
     
-    return violations;
+    return null;
   }
 
+  checkTransactionAccess_InMethod(methodBody) {
+    // Check for transaction method calls
+    for (const txMethod of this.transactionMethods) {
+      // Pattern: this.(dataSource|connection|manager).transaction(...)
+      const txPattern = new RegExp(`this\\.(dataSource|connection|entityManager|manager|db)\\s*\\.\\s*${txMethod}\\s*\\(`, 'i');
+      const match = methodBody.match(txPattern);
+      if (match) {
+        return { operation: txMethod, type: 'direct-transaction', matchIndex: match.index };
+      }
+      
+      // Pattern: global transaction calls
+      const globalTxPattern = new RegExp(`\\b${txMethod}\\s*\\(`, 'i');
+      // Make sure it's not a repository method call
+      const contextPattern = new RegExp(`this\\.(\\w+Repository|\\w+Repo)\\s*\\.\\s*${txMethod}\\s*\\(`, 'i');
+      
+      if (globalTxPattern.test(methodBody) && !contextPattern.test(methodBody)) {
+        const globalMatch = methodBody.match(globalTxPattern);
+        return { operation: txMethod, type: 'global-transaction', matchIndex: globalMatch.index };
+      }
+    }
+    
+    return null;
+  }
+
+  checkQueryRunnerAccess_InMethod(methodBody) {
+    // Check for QueryRunner usage
+    const queryRunnerPatterns = [
+      /this\.(dataSource|connection)\s*\.\s*createQueryRunner\s*\(/i,
+      /this\.(dataSource|connection)\s*\.\s*getQueryRunner\s*\(/i,
+      /\bcreateQueryRunner\s*\(\s*\)/i,
+      /queryRunner\s*\.\s*(connect|startTransaction|commitTransaction|rollbackTransaction|release)/i
+    ];
+    
+    for (const pattern of queryRunnerPatterns) {
+      const match = methodBody.match(pattern);
+      if (match) {
+        return { operation: 'QueryRunner', detected: true, matchIndex: match.index };
+      }
+    }
+    
+    return null;
+  }
+
+  checkSchemaOperations_InMethod(methodBody) {
+    // Check for schema and migration operations
+    for (const schemaOp of this.schemaOperations) {
+      const schemaPattern = new RegExp(`this\\.(dataSource|connection|db)\\s*\\.\\s*${schemaOp}\\s*\\(`, 'i');
+      const match = methodBody.match(schemaPattern);
+      if (match) {
+        return { operation: schemaOp, severity: 'error', matchIndex: match.index };
+      }
+    }
+    
+    return null;
+  }
+
+  // ============================================================
+  // SERVICE CLASS-LEVEL CHECKERS
+  // ============================================================
+
   checkRepositoryInjection(cls) {
     try {
       // Check constructor parameters
@@ -329,6 +563,54 @@ class C033SymbolBasedAnalyzer {
     return false;
   }
 
+  checkDatabaseInjection(cls) {
+    try {
+      // Check constructor parameters for database-related injections
+      const constructor = cls.getConstructors()[0];
+      if (constructor) {
+        const params = constructor.getParameters();
+        for (const param of params) {
+          const paramName = param.getName().toLowerCase();
+          const paramType = param.getType().getText().toLowerCase();
+          
+          // Check for database connection properties
+          for (const dbProp of this.databaseProperties) {
+            if (paramName.includes(dbProp) || paramType.includes(dbProp)) {
+              return true;
+            }
+          }
+          
+          // Check for ORM framework types
+          for (const framework of this.ormFrameworks) {
+            if (paramType.includes(framework.toLowerCase())) {
+              // Exclude Repository types - those are good
+              if (framework.includes('Repository')) {
+                continue;
+              }
+              return true;
+            }
+          }
+        }
+      }
+      
+      // Check class properties
+      const properties = cls.getProperties();
+      for (const prop of properties) {
+        const propName = prop.getName().toLowerCase();
+        
+        for (const dbProp of this.databaseProperties) {
+          if (propName.includes(dbProp)) {
+            return true;
+          }
+        }
+      }
+    } catch (error) {
+      // Ignore errors
+    }
+    
+    return false;
+  }
+
   checkDirectDatabaseAccess(cls) {
     try {
       const classText = cls.getText();
@@ -354,6 +636,10 @@ class C033SymbolBasedAnalyzer {
     return false;
   }
 
+  // ============================================================
+  // REPOSITORY FILE ANALYSIS
+  // ============================================================
+
   analyzeRepositoryFile(sourceFile, filePath) {
     const violations = [];
     const classes = sourceFile.getClasses();
@@ -475,6 +761,10 @@ class C033SymbolBasedAnalyzer {
     return false;
   }
 
+  // ============================================================
+  // CONTROLLER FILE ANALYSIS
+  // ============================================================
+
   analyzeControllerFile(sourceFile, filePath) {
     const violations = [];
     const classes = sourceFile.getClasses();