@terpjs/eslint-boundaries 0.21.0 → 0.22.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@terpjs/eslint-boundaries",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "type": "module",
   "description": "Terp frontend boundary rules (as data) + the ESLint adapter: no cross-module imports, no package internals, design-token-only styling (no style/className/module stylesheets), token-styled components for raw HTML tags, router-only in-app links, generated-client-only, and browser XSS/navigation sink bans. Strict-only (no modes); governed opt-outs via terp-allow markers + the escape-hatch budget ratchet (terp-boundaries-budget).",
   "main": "./src/index.js",
@@ -25,7 +25,7 @@
     "typescript-eslint": "^8.69.0"
   },
   "devDependencies": {
-    "@terpjs/spec": "0.33.0",
+    "@terpjs/spec": "0.34.0",
     "eslint": "^10.10.0",
     "vitest": "^5.0.0"
   },

package/src/index.js

@@ -918,6 +918,12 @@ const clipboardMessage =
   "TypeError that no .catch and no try around an await ever sees. Use copyText or " +
   "useCopyToClipboard from @terpjs/react-core, which feature-detect, fall back, and " +
   "report a refusal instead of failing silently.";
+const randomUuidMessage =
+  "crypto.randomUUID exists only in a secure context and lib.dom declares it "
+  + "unconditionally, so on an http origin this is a call on undefined -- a SYNCHRONOUS "
+  + "TypeError that type-checks cleanly and never fires on localhost, so no test sees it. "
+  + "Use randomUuid from @terpjs/react-core, which falls back to crypto.getRandomValues "
+  + "(not secure-context-gated) for the same entropy.";
 const deepImportMessage =
   "Import from the package root (@terpjs/react-core, @terpjs/contract), not its internals.";
 const styleImportMessage =
@@ -998,11 +1004,32 @@ function restrictedSyntaxWithCatalogIds() {
         },
       ]
     : [];
+  const rawRandomUuid = BOUNDARY_SPEC.restrictRawRandomUuid
+    ? [
+        {
+          // Any ACCESS, like the clipboard rule beside it and for the same reason:
+          // `const gen = crypto.randomUUID` binds the same undefined one line before the
+          // call that throws on it.
+          catalogId: "frontend/no-raw-random-uuid",
+          selector:
+            "MemberExpression[object.name='crypto'][property.name='randomUUID'], MemberExpression[object.name='crypto'][computed=true][property.value='randomUUID'], MemberExpression[object.type='MemberExpression'][object.object.name=/^(window|globalThis|self)$/][object.property.name='crypto'][property.name='randomUUID'], MemberExpression[object.type='MemberExpression'][object.object.name=/^(window|globalThis|self)$/][object.computed=true][object.property.value='crypto'][property.name='randomUUID']",
+          message: randomUuidMessage,
+        },
+        {
+          // The destructuring spelling, which no member-expression selector reaches.
+          catalogId: "frontend/no-raw-random-uuid",
+          selector:
+            "VariableDeclarator[init.name='crypto'] ObjectPattern > Property[key.name='randomUUID'], VariableDeclarator[init.type='MemberExpression'][init.property.name='crypto'] ObjectPattern > Property[key.name='randomUUID']",
+          message: randomUuidMessage,
+        },
+      ]
+    : [];
   return [
     ...rawElements,
     ...rawAttributes,
     ...inAppAnchors,
     ...rawClipboard,
+    ...rawRandomUuid,
     {
       catalogId: "frontend/no-dom-html-injection",
       selector: "JSXAttribute[name.name='dangerouslySetInnerHTML']",

package/src/index.test.js

@@ -196,6 +196,61 @@ describe("terpBoundaries", () => {
     expect(await lint("export const pick = (o) => o.clipboard;")).toEqual([]);
   });
 
+  it("refuses crypto.randomUUID in every spelling that binds the same undefined", async () => {
+    // Secure-context-only, declared unconditionally by lib.dom: on an http origin each of
+    // these is a synchronous TypeError that type-checks cleanly and never fires on
+    // localhost, so neither tsc nor CI ever sees it.
+    expect(await lint("export const id = () => crypto.randomUUID();")).toContain(
+      "no-restricted-syntax",
+    );
+    expect(await lint('export const id = () => crypto["randomUUID"]();')).toContain(
+      "no-restricted-syntax",
+    );
+    expect(await lint("export const id = () => window.crypto.randomUUID();")).toContain(
+      "no-restricted-syntax",
+    );
+    expect(await lint("export const id = () => globalThis.crypto.randomUUID();")).toContain(
+      "no-restricted-syntax",
+    );
+    expect(await lint("export const id = () => self.crypto.randomUUID();")).toContain(
+      "no-restricted-syntax",
+    );
+    expect(
+      await lint('export const id = () => globalThis["crypto"].randomUUID();'),
+    ).toContain("no-restricted-syntax");
+    // Bound rather than called: the reference is already the broken one.
+    expect(await lint("export const gen = crypto.randomUUID;")).toContain(
+      "no-restricted-syntax",
+    );
+    expect(await lint("export const { randomUUID } = crypto;")).toContain(
+      "no-restricted-syntax",
+    );
+  });
+
+  it("accepts the react-core uuid seam, and the API that is not gated", async () => {
+    expect(
+      await lint(
+        'import { randomUuid } from "@terpjs/react-core";\nexport const id = () => randomUuid();',
+      ),
+    ).toEqual([]);
+    // getRandomValues is NOT secure-context-gated, so it is not this defect and the seam
+    // itself is built on it. Flagging it would make the rule a word filter on "crypto".
+    expect(
+      await lint("export const bytes = () => crypto.getRandomValues(new Uint8Array(16));"),
+    ).toEqual([]);
+    // And a `randomUUID` on something that is not `crypto` is somebody else's function.
+    expect(await lint("export const id = (lib) => lib.randomUUID();")).toEqual([]);
+  });
+
+  it("honours the uuid rule's declared escape hatch, and only its own name", async () => {
+    const call = "export const id = () => crypto.randomUUID();";
+    expect(
+      await lint(`// terp-allow-no-raw-random-uuid: https-only admin origin\n${call}`),
+    ).toEqual([]);
+    const wrong = await lint(`// terp-allow-no-random-uuid: typo\n${call}`);
+    expect(wrong).toContain("no-restricted-syntax");
+  });
+
   it("honours the clipboard rule's declared escape hatch, and only its own name", async () => {
     // The catalog entry declares `// terp-allow-no-raw-clipboard: <reason>`, and a
     // declared opt-out that does not actually suppress is a false promise in the

package/src/spec.js

@@ -16,7 +16,7 @@
  * NOT by this package's own suite, which certification runs against candidate spec releases
  * whose version is allowed to be newer).
  */
-export const SPEC_VERSION = "0.33.0";
+export const SPEC_VERSION = "0.34.0";
 
 export const BOUNDARY_SPEC = {
   /** Every app-authored TypeScript source file whose user-facing copy must be cataloged. */
@@ -120,6 +120,7 @@ export const BOUNDARY_SPEC = {
    * `copyText` / `useCopyToClipboard` feature-detect and report a refusal instead.
    */
   restrictRawClipboard: true,
+  restrictRawRandomUuid: true,
   /**
    * The governed escape hatch (the frontend analog of the backend's `# arch-allow-*`): a
    * justified `// terp-allow-<rule>: <reason>` comment on (or immediately above) a violating