@tailor-platform/eslint-plugin-sdk 0.0.0

package/README.md

@@ -0,0 +1,97 @@
+# @tailor-platform/eslint-plugin-sdk
+
+Lint rules for applications built with `@tailor-platform/sdk`. The plugin uses the ESLint v9
+plugin API and can run with either ESLint or Oxlint.
+
+## Installation
+
+Install the plugin with your linter:
+
+```bash
+pnpm add --save-dev @tailor-platform/eslint-plugin-sdk oxlint
+```
+
+## Oxlint
+
+Add the plugin and its rules to `.oxlintrc.json`:
+
+```json
+{
+  "jsPlugins": [
+    {
+      "name": "tailor-sdk",
+      "specifier": "@tailor-platform/eslint-plugin-sdk"
+    }
+  ],
+  "rules": {
+    "tailor-sdk/no-api-prefix-in-path-pattern": "warn",
+    "tailor-sdk/no-unconditional-permit": "warn"
+  }
+}
+```
+
+Oxlint JavaScript plugins are currently alpha. These rules use syntax and import binding analysis
+only; they do not require type-aware custom rule support.
+
+## ESLint
+
+Use the recommended flat config with ESLint v9 or later:
+
+```js
+import tailorSdk from "@tailor-platform/eslint-plugin-sdk";
+
+export default [tailorSdk.configs.recommended];
+```
+
+## Rules
+
+### `no-api-prefix-in-path-pattern` (warning)
+
+HTTP adapter path patterns are matched after the platform's `/api` prefix.
+
+Incorrect:
+
+```ts
+export default createHttpAdapter({
+  pathPattern: "/api/orders/*",
+});
+```
+
+Correct:
+
+```ts
+export default createHttpAdapter({
+  pathPattern: "/orders/*",
+});
+```
+
+### `no-unconditional-permit` (warning)
+
+Permission entries with empty `conditions` and `permit: true` grant access to every request, as do
+the `unsafeAllowAll*` constants. Use them only during local development.
+
+Incorrect:
+
+```ts
+export default db.type("User", fields).permission({
+  create: [{ conditions: [], permit: true }],
+  // ...
+});
+
+export const defaultPermission = unsafeAllowAllTypePermission;
+```
+
+Correct:
+
+```ts
+export default db.type("User", fields).permission({
+  create: [{ conditions: [[{ user: "role" }, "=", "ADMIN"]], permit: true }],
+  // ...
+});
+```
+
+The rule checks `.permission()` / `.gqlPermission()` on `db.type()` chains and the `permission`
+option of `defineIdp()`, including values defined as `const` in the same file.
+
+The rules recognize named and namespace imports from `@tailor-platform/sdk`, including local import
+aliases. Same-named functions imported from other packages are ignored.

package/index.d.ts

@@ -0,0 +1,21 @@
+import type { ESLint, Linter, Rule } from "eslint";
+
+export type TailorSdkRuleName = "no-api-prefix-in-path-pattern" | "no-unconditional-permit";
+
+type RecommendedRules = {
+  readonly [RuleName in TailorSdkRuleName as `tailor-sdk/${RuleName}`]: Linter.RuleEntry;
+};
+
+export interface TailorSdkPlugin extends Omit<ESLint.Plugin, "configs" | "meta" | "rules"> {
+  readonly meta: {
+    readonly name: "@tailor-platform/eslint-plugin-sdk";
+  };
+  readonly rules: Record<TailorSdkRuleName, Rule.RuleModule>;
+  readonly configs: {
+    readonly recommended: Linter.Config<RecommendedRules>;
+  };
+}
+
+declare const plugin: TailorSdkPlugin;
+
+export default plugin;

package/index.js

@@ -0,0 +1,28 @@
+import noApiPrefixInPathPattern from "./rules/no-api-prefix-in-path-pattern.js";
+import noUnconditionalPermit from "./rules/no-unconditional-permit.js";
+
+const rules = {
+  "no-api-prefix-in-path-pattern": noApiPrefixInPathPattern,
+  "no-unconditional-permit": noUnconditionalPermit,
+};
+
+const plugin = {
+  meta: {
+    name: "@tailor-platform/eslint-plugin-sdk",
+  },
+  rules,
+  configs: {},
+};
+
+plugin.configs.recommended = {
+  name: "tailor-sdk/recommended",
+  plugins: {
+    "tailor-sdk": plugin,
+  },
+  rules: {
+    "tailor-sdk/no-api-prefix-in-path-pattern": "warn",
+    "tailor-sdk/no-unconditional-permit": "warn",
+  },
+};
+
+export default plugin;

package/lib/ast.js

@@ -0,0 +1,64 @@
+const EXPRESSION_WRAPPERS = new Set([
+  "ChainExpression",
+  "TSAsExpression",
+  "TSInstantiationExpression",
+  "TSNonNullExpression",
+  "TSSatisfiesExpression",
+  "TSTypeAssertion",
+  "TypeCastExpression",
+]);
+
+export function unwrapExpression(node) {
+  let current = node;
+  while (current !== null && current !== undefined && EXPRESSION_WRAPPERS.has(current.type)) {
+    current = current.expression;
+  }
+  return current;
+}
+
+export function memberName(node) {
+  if (!node || (node.type !== "MemberExpression" && node.type !== "OptionalMemberExpression")) {
+    return null;
+  }
+  if (!node.computed && node.property.type === "Identifier") {
+    return node.property.name;
+  }
+  if (
+    node.computed &&
+    node.property.type === "Literal" &&
+    typeof node.property.value === "string"
+  ) {
+    return node.property.value;
+  }
+  return null;
+}
+
+export function nodeStart(node) {
+  if (Array.isArray(node.range)) return node.range[0];
+  return typeof node.start === "number" ? node.start : 0;
+}
+
+export function staticString(node) {
+  const value = unwrapExpression(node);
+  if (value?.type === "Literal" && typeof value.value === "string") {
+    return value.value;
+  }
+  if (value?.type === "TemplateLiteral" && value.expressions.length === 0) {
+    return value.quasis[0]?.value.cooked ?? value.quasis[0]?.value.raw ?? null;
+  }
+  return null;
+}
+
+export function objectProperty(object, name) {
+  const value = unwrapExpression(object);
+  if (value?.type !== "ObjectExpression") return null;
+  return (
+    value.properties.findLast((property) => {
+      if (property.type !== "Property" || property.kind !== "init") return false;
+      if (!property.computed && property.key.type === "Identifier") {
+        return property.key.name === name;
+      }
+      return property.key.type === "Literal" && property.key.value === name;
+    }) ?? null
+  );
+}

package/lib/sdk-bindings.js

@@ -0,0 +1,87 @@
+import { memberName, nodeStart, unwrapExpression } from "./ast.js";
+
+export const SDK_CONFIGURE_MODULE = "@tailor-platform/sdk";
+
+function findVariable(sourceCode, node) {
+  let scope = sourceCode.getScope(node);
+  while (scope !== null) {
+    const variable = scope.set.get(node.name);
+    if (variable) return variable;
+    scope = scope.upper;
+  }
+  return null;
+}
+
+function isBindingReference(context, node, binding) {
+  if (node?.type !== "Identifier") return false;
+  const variable = findVariable(context.sourceCode, node);
+  return (
+    variable?.identifiers.some((identifier) => nodeStart(identifier) === nodeStart(binding)) ??
+    false
+  );
+}
+
+export function variableInitializer(context, node) {
+  if (node?.type !== "Identifier") return null;
+  const variable = findVariable(context.sourceCode, node);
+  const definition = variable?.defs.find(
+    (entry) =>
+      entry.type === "Variable" &&
+      entry.node?.type === "VariableDeclarator" &&
+      entry.node.parent?.kind === "const",
+  );
+  return definition?.node.init ?? null;
+}
+
+function createImportTracker(context, modules) {
+  const named = new Map();
+  const namespaces = new Map();
+
+  return {
+    track(node) {
+      if (!modules.has(node.source.value)) return;
+      for (const specifier of node.specifiers) {
+        if (specifier.type === "ImportNamespaceSpecifier") {
+          namespaces.set(specifier.local.name, specifier.local);
+          continue;
+        }
+        if (specifier.type !== "ImportSpecifier" || specifier.importKind === "type") continue;
+        const imported =
+          specifier.imported.type === "Identifier"
+            ? specifier.imported.name
+            : String(specifier.imported.value);
+        named.set(specifier.local.name, { binding: specifier.local, imported });
+      }
+    },
+
+    callName(call) {
+      const callee = unwrapExpression(call.callee);
+      if (callee?.type === "Identifier") {
+        const entry = named.get(callee.name);
+        return entry && isBindingReference(context, callee, entry.binding) ? entry.imported : null;
+      }
+      if (callee?.type !== "MemberExpression" && callee?.type !== "OptionalMemberExpression") {
+        return null;
+      }
+      const object = unwrapExpression(callee.object);
+      if (object?.type !== "Identifier" || !this.isNamespace(object)) return null;
+      return memberName(callee);
+    },
+
+    importedAs(node, importedName) {
+      if (node?.type !== "Identifier") return false;
+      const entry = named.get(node.name);
+      return entry?.imported === importedName && isBindingReference(context, node, entry.binding);
+    },
+
+    isNamespace(node) {
+      if (node?.type !== "Identifier") return false;
+      const binding = namespaces.get(node.name);
+      return binding !== undefined && isBindingReference(context, node, binding);
+    },
+  };
+}
+
+export function configureImportTracker(context) {
+  return createImportTracker(context, new Set([SDK_CONFIGURE_MODULE]));
+}

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "@tailor-platform/eslint-plugin-sdk",
+  "version": "0.0.0",
+  "description": "Lint rules for Tailor Platform SDK applications",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/tailor-platform/sdk.git",
+    "directory": "packages/eslint-plugin-sdk"
+  },
+  "files": [
+    "index.js",
+    "index.d.ts",
+    "lib",
+    "rules",
+    "README.md"
+  ],
+  "type": "module",
+  "main": "./index.js",
+  "types": "./index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./index.d.ts",
+      "import": "./index.js",
+      "default": "./index.js"
+    }
+  },
+  "scripts": {
+    "lint": "oxlint .",
+    "lint:fix": "oxlint . --fix",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "publint": "publint --strict"
+  },
+  "dependencies": {
+    "@types/eslint": "9.6.1"
+  },
+  "devDependencies": {
+    "eslint": "9.39.3",
+    "oxlint": "1.72.0",
+    "typescript": "6.0.3",
+    "vitest": "4.1.10"
+  },
+  "peerDependencies": {
+    "eslint": ">=9.0.0"
+  },
+  "peerDependenciesMeta": {
+    "eslint": {
+      "optional": true
+    }
+  },
+  "engines": {
+    "node": ">=22.14.0"
+  }
+}

package/rules/no-api-prefix-in-path-pattern.js

@@ -0,0 +1,36 @@
+import { objectProperty, staticString } from "../lib/ast.js";
+import { configureImportTracker, variableInitializer } from "../lib/sdk-bindings.js";
+
+export default {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow the external /api prefix in HTTP adapter path patterns.",
+    },
+    messages: {
+      prefixed: "pathPattern is matched after the /api prefix; remove the leading /api.",
+    },
+    schema: [],
+  },
+  create(context) {
+    const imports = configureImportTracker(context);
+    const calls = [];
+
+    return {
+      ImportDeclaration: (node) => imports.track(node),
+      CallExpression: (node) => calls.push(node),
+      "Program:exit"() {
+        for (const call of calls) {
+          if (imports.callName(call) !== "createHttpAdapter") continue;
+          let options = call.arguments[0];
+          if (options?.type === "Identifier") options = variableInitializer(context, options);
+          const property = objectProperty(options, "pathPattern");
+          if (!property || property.type !== "Property") continue;
+          const pattern = staticString(property.value);
+          if (pattern !== "/api" && !pattern?.startsWith("/api/")) continue;
+          context.report({ node: property.value, messageId: "prefixed" });
+        }
+      },
+    };
+  },
+};

package/rules/no-unconditional-permit.js

@@ -0,0 +1,196 @@
+import { memberName, objectProperty, unwrapExpression } from "../lib/ast.js";
+import {
+  configureImportTracker,
+  SDK_CONFIGURE_MODULE,
+  variableInitializer,
+} from "../lib/sdk-bindings.js";
+
+const UNSAFE_CONSTANTS = new Set([
+  "unsafeAllowAllTypePermission",
+  "unsafeAllowAllGqlPermission",
+  "unsafeAllowAllIdPPermission",
+]);
+
+function isValueReference(node) {
+  const parent = node.parent;
+  if (!parent) return false;
+  switch (parent.type) {
+    case "ImportSpecifier":
+    case "ImportDefaultSpecifier":
+    case "ImportNamespaceSpecifier":
+      return false;
+    case "MemberExpression":
+    case "OptionalMemberExpression":
+      return parent.object === node || parent.computed;
+    case "Property":
+      return parent.value === node || parent.computed;
+    default:
+      return true;
+  }
+}
+
+function resolveValue(context, node) {
+  let current = unwrapExpression(node);
+  const seen = new Set();
+  while (current?.type === "Identifier" && !seen.has(current.name)) {
+    seen.add(current.name);
+    const initializer = variableInitializer(context, current);
+    if (initializer === null) break;
+    current = unwrapExpression(initializer);
+  }
+  return current;
+}
+
+function isDbReference(imports, node) {
+  const object = unwrapExpression(node);
+  if (object?.type === "Identifier") return imports.importedAs(object, "db");
+  if (object?.type === "MemberExpression" || object?.type === "OptionalMemberExpression") {
+    return memberName(object) === "db" && imports.isNamespace(unwrapExpression(object.object));
+  }
+  return false;
+}
+
+function isDbTypeReceiver(context, imports, node) {
+  let current = resolveValue(context, node);
+  while (current?.type === "CallExpression") {
+    const callee = unwrapExpression(current.callee);
+    if (callee?.type !== "MemberExpression" && callee?.type !== "OptionalMemberExpression") {
+      return false;
+    }
+    if (memberName(callee) === "type" && isDbReference(imports, callee.object)) return true;
+    current = resolveValue(context, callee.object);
+  }
+  return false;
+}
+
+function permissionArgument(context, imports, call) {
+  if (imports.callName(call) === "defineIdp") {
+    const options = resolveValue(context, call.arguments[1]);
+    const property = objectProperty(options, "permission");
+    return property?.type === "Property" ? property.value : null;
+  }
+  const callee = unwrapExpression(call.callee);
+  if (callee?.type !== "MemberExpression" && callee?.type !== "OptionalMemberExpression") {
+    return null;
+  }
+  const method = memberName(callee);
+  if (method !== "permission" && method !== "gqlPermission") return null;
+  if (!isDbTypeReceiver(context, imports, callee.object)) return null;
+  return call.arguments[0] ?? null;
+}
+
+function isUnconditionalObjectEntry(context, entry) {
+  const conditions = objectProperty(entry, "conditions");
+  const permit = objectProperty(entry, "permit");
+  if (conditions?.type !== "Property" || permit?.type !== "Property") return false;
+  const conditionsValue = resolveValue(context, conditions.value);
+  const permitValue = unwrapExpression(permit.value);
+  return (
+    conditionsValue?.type === "ArrayExpression" &&
+    conditionsValue.elements.length === 0 &&
+    permitValue?.type === "Literal" &&
+    permitValue.value === true
+  );
+}
+
+function isUnconditionalShorthandEntry(entry) {
+  let permit = true;
+  for (const element of entry.elements) {
+    if (element === null || element.type === "SpreadElement") return false;
+    const value = unwrapExpression(element);
+    if (value?.type !== "Literal" || typeof value.value !== "boolean") return false;
+    permit = value.value;
+  }
+  return permit;
+}
+
+function reportEntry(context, node) {
+  const entry = resolveValue(context, node);
+  if (
+    (entry?.type === "ObjectExpression" && isUnconditionalObjectEntry(context, entry)) ||
+    (entry?.type === "ArrayExpression" && isUnconditionalShorthandEntry(entry))
+  ) {
+    context.report({ node: entry, messageId: "unconditionalEntry" });
+  }
+}
+
+function reportEntryList(context, node) {
+  const entries = resolveValue(context, node);
+  if (entries?.type !== "ArrayExpression") return;
+  for (const element of entries.elements) {
+    if (element !== null && element.type !== "SpreadElement") reportEntry(context, element);
+  }
+}
+
+function reportUnconditionalEntries(context, node) {
+  const value = resolveValue(context, node);
+  if (value?.type === "ArrayExpression") {
+    reportEntryList(context, value);
+    return;
+  }
+  if (value?.type !== "ObjectExpression") return;
+  for (const property of value.properties) {
+    if (property.type === "Property") reportEntryList(context, property.value);
+  }
+}
+
+export default {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Disallow permission settings that grant access unconditionally.",
+    },
+    messages: {
+      unsafeConstant:
+        "{{name}} grants access unconditionally; define restrictive permission conditions instead.",
+      unconditionalEntry:
+        "This permission entry permits access without any conditions; add conditions or remove it.",
+    },
+    schema: [],
+  },
+  create(context) {
+    const imports = configureImportTracker(context);
+    const unsafeLocals = new Map();
+    const calls = [];
+    const identifiers = [];
+    const members = [];
+
+    return {
+      ImportDeclaration(node) {
+        imports.track(node);
+        if (node.source.value !== SDK_CONFIGURE_MODULE) return;
+        for (const specifier of node.specifiers) {
+          if (specifier.type !== "ImportSpecifier" || specifier.importKind === "type") continue;
+          const imported =
+            specifier.imported.type === "Identifier"
+              ? specifier.imported.name
+              : String(specifier.imported.value);
+          if (UNSAFE_CONSTANTS.has(imported)) unsafeLocals.set(specifier.local.name, imported);
+        }
+      },
+      CallExpression: (node) => calls.push(node),
+      Identifier: (node) => identifiers.push(node),
+      MemberExpression: (node) => {
+        if (UNSAFE_CONSTANTS.has(memberName(node) ?? "")) members.push(node);
+      },
+      "Program:exit"() {
+        for (const node of identifiers) {
+          const name = unsafeLocals.get(node.name);
+          if (name === undefined || !isValueReference(node) || !imports.importedAs(node, name)) {
+            continue;
+          }
+          context.report({ node, messageId: "unsafeConstant", data: { name } });
+        }
+        for (const node of members) {
+          if (!imports.isNamespace(unwrapExpression(node.object))) continue;
+          const name = memberName(node);
+          context.report({ node, messageId: "unsafeConstant", data: { name } });
+        }
+        for (const call of calls) {
+          const permission = permissionArgument(context, imports, call);
+          if (permission !== null) reportUnconditionalEntries(context, permission);
+        }
+      },
+    };
+  },
+};