@terpjs/eslint-boundaries 0.21.0 → 0.23.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@terpjs/eslint-boundaries",
-  "version": "0.21.0",
+  "version": "0.23.0",
   "type": "module",
   "description": "Terp frontend boundary rules (as data) + the ESLint adapter: no cross-module imports, no package internals, design-token-only styling (no style/className/module stylesheets), token-styled components for raw HTML tags, router-only in-app links, generated-client-only, and browser XSS/navigation sink bans. Strict-only (no modes); governed opt-outs via terp-allow markers + the escape-hatch budget ratchet (terp-boundaries-budget).",
   "main": "./src/index.js",
@@ -25,7 +25,7 @@
     "typescript-eslint": "^8.69.0"
   },
   "devDependencies": {
-    "@terpjs/spec": "0.33.0",
+    "@terpjs/spec": "0.35.0",
     "eslint": "^10.10.0",
     "vitest": "^5.0.0"
   },

package/src/i18n.test.js

@@ -144,6 +144,18 @@ describe("locale catalog completeness", () => {
     expect(dynamicTrans.find((message) => message.ruleId === "terp/locale-catalogs-complete")?.message)
       .toContain("requires static non-empty id and message");
 
+    // A spread is still refused - the catalog is inventoried statically - but it is the
+    // one shape with a sanctioned alternative, so the refusal names it. Sharing one
+    // descriptor between two screens is ordinary; only its JSX-body spelling is not.
+    const spreadTrans = await lintWithCatalog(
+      { sourceLocale: "en", locales: { en: {}, nl: {} } },
+      'export const W = () => <Trans {...TITLE} />;',
+    );
+    const spreadMessage = spreadTrans
+      .find((message) => message.ruleId === "terp/locale-catalogs-complete")?.message;
+    expect(spreadMessage).toContain("useUiText");
+    expect(spreadMessage).toContain("text(DESCRIPTOR)");
+
     const staleAllowlist = await lintWithCatalog(
       {
         sourceLocale: "en",

package/src/index.js

@@ -788,9 +788,23 @@ const localeCatalogsComplete = {
         if (jsxName(node.name) !== "Trans") return;
         const descriptor = transDescriptor(node);
         if (descriptor === null) {
+          // A spread is the one shape with a sanctioned alternative, and the generic
+          // message sent authors looking for a way to make the spread work instead.
+          // One descriptor shared by two screens is ordinary; what cannot be shared is
+          // the JSX-body spelling of it, because the catalog is inventoried statically
+          // and `{...DESCRIPTOR}` carries no attributes to read. The resolver renders
+          // the same copy from the same constant, so name it rather than the refusal.
+          const spread = node.attributes.some(
+            (attribute) => attribute.type === "JSXSpreadAttribute",
+          );
           context.report({
             node,
-            message: "<Trans> requires static non-empty id and message attributes.",
+            message: spread
+              ? "<Trans> reads its id and message as static attributes, so a shared UiText " +
+                "constant cannot be spread into it. Render the same constant through the " +
+                "resolver instead: const text = useUiText() in the component, then " +
+                "{text(DESCRIPTOR)} where the copy goes."
+              : "<Trans> requires static non-empty id and message attributes.",
           });
           return;
         }
@@ -918,6 +932,12 @@ const clipboardMessage =
   "TypeError that no .catch and no try around an await ever sees. Use copyText or " +
   "useCopyToClipboard from @terpjs/react-core, which feature-detect, fall back, and " +
   "report a refusal instead of failing silently.";
+const randomUuidMessage =
+  "crypto.randomUUID exists only in a secure context and lib.dom declares it "
+  + "unconditionally, so on an http origin this is a call on undefined -- a SYNCHRONOUS "
+  + "TypeError that type-checks cleanly and never fires on localhost, so no test sees it. "
+  + "Use randomUuid from @terpjs/react-core, which falls back to crypto.getRandomValues "
+  + "(not secure-context-gated) for the same entropy.";
 const deepImportMessage =
   "Import from the package root (@terpjs/react-core, @terpjs/contract), not its internals.";
 const styleImportMessage =
@@ -998,11 +1018,32 @@ function restrictedSyntaxWithCatalogIds() {
         },
       ]
     : [];
+  const rawRandomUuid = BOUNDARY_SPEC.restrictRawRandomUuid
+    ? [
+        {
+          // Any ACCESS, like the clipboard rule beside it and for the same reason:
+          // `const gen = crypto.randomUUID` binds the same undefined one line before the
+          // call that throws on it.
+          catalogId: "frontend/no-raw-random-uuid",
+          selector:
+            "MemberExpression[object.name='crypto'][property.name='randomUUID'], MemberExpression[object.name='crypto'][computed=true][property.value='randomUUID'], MemberExpression[object.type='MemberExpression'][object.object.name=/^(window|globalThis|self)$/][object.property.name='crypto'][property.name='randomUUID'], MemberExpression[object.type='MemberExpression'][object.object.name=/^(window|globalThis|self)$/][object.computed=true][object.property.value='crypto'][property.name='randomUUID']",
+          message: randomUuidMessage,
+        },
+        {
+          // The destructuring spelling, which no member-expression selector reaches.
+          catalogId: "frontend/no-raw-random-uuid",
+          selector:
+            "VariableDeclarator[init.name='crypto'] ObjectPattern > Property[key.name='randomUUID'], VariableDeclarator[init.type='MemberExpression'][init.property.name='crypto'] ObjectPattern > Property[key.name='randomUUID']",
+          message: randomUuidMessage,
+        },
+      ]
+    : [];
   return [
     ...rawElements,
     ...rawAttributes,
     ...inAppAnchors,
     ...rawClipboard,
+    ...rawRandomUuid,
     {
       catalogId: "frontend/no-dom-html-injection",
       selector: "JSXAttribute[name.name='dangerouslySetInnerHTML']",

package/src/index.test.js

@@ -196,6 +196,61 @@ describe("terpBoundaries", () => {
     expect(await lint("export const pick = (o) => o.clipboard;")).toEqual([]);
   });
 
+  it("refuses crypto.randomUUID in every spelling that binds the same undefined", async () => {
+    // Secure-context-only, declared unconditionally by lib.dom: on an http origin each of
+    // these is a synchronous TypeError that type-checks cleanly and never fires on
+    // localhost, so neither tsc nor CI ever sees it.
+    expect(await lint("export const id = () => crypto.randomUUID();")).toContain(
+      "no-restricted-syntax",
+    );
+    expect(await lint('export const id = () => crypto["randomUUID"]();')).toContain(
+      "no-restricted-syntax",
+    );
+    expect(await lint("export const id = () => window.crypto.randomUUID();")).toContain(
+      "no-restricted-syntax",
+    );
+    expect(await lint("export const id = () => globalThis.crypto.randomUUID();")).toContain(
+      "no-restricted-syntax",
+    );
+    expect(await lint("export const id = () => self.crypto.randomUUID();")).toContain(
+      "no-restricted-syntax",
+    );
+    expect(
+      await lint('export const id = () => globalThis["crypto"].randomUUID();'),
+    ).toContain("no-restricted-syntax");
+    // Bound rather than called: the reference is already the broken one.
+    expect(await lint("export const gen = crypto.randomUUID;")).toContain(
+      "no-restricted-syntax",
+    );
+    expect(await lint("export const { randomUUID } = crypto;")).toContain(
+      "no-restricted-syntax",
+    );
+  });
+
+  it("accepts the react-core uuid seam, and the API that is not gated", async () => {
+    expect(
+      await lint(
+        'import { randomUuid } from "@terpjs/react-core";\nexport const id = () => randomUuid();',
+      ),
+    ).toEqual([]);
+    // getRandomValues is NOT secure-context-gated, so it is not this defect and the seam
+    // itself is built on it. Flagging it would make the rule a word filter on "crypto".
+    expect(
+      await lint("export const bytes = () => crypto.getRandomValues(new Uint8Array(16));"),
+    ).toEqual([]);
+    // And a `randomUUID` on something that is not `crypto` is somebody else's function.
+    expect(await lint("export const id = (lib) => lib.randomUUID();")).toEqual([]);
+  });
+
+  it("honours the uuid rule's declared escape hatch, and only its own name", async () => {
+    const call = "export const id = () => crypto.randomUUID();";
+    expect(
+      await lint(`// terp-allow-no-raw-random-uuid: https-only admin origin\n${call}`),
+    ).toEqual([]);
+    const wrong = await lint(`// terp-allow-no-random-uuid: typo\n${call}`);
+    expect(wrong).toContain("no-restricted-syntax");
+  });
+
   it("honours the clipboard rule's declared escape hatch, and only its own name", async () => {
     // The catalog entry declares `// terp-allow-no-raw-clipboard: <reason>`, and a
     // declared opt-out that does not actually suppress is a false promise in the

package/src/spec.js

@@ -16,7 +16,7 @@
  * NOT by this package's own suite, which certification runs against candidate spec releases
  * whose version is allowed to be newer).
  */
-export const SPEC_VERSION = "0.33.0";
+export const SPEC_VERSION = "0.35.0";
 
 export const BOUNDARY_SPEC = {
   /** Every app-authored TypeScript source file whose user-facing copy must be cataloged. */
@@ -120,6 +120,7 @@ export const BOUNDARY_SPEC = {
    * `copyText` / `useCopyToClipboard` feature-detect and report a refusal instead.
    */
   restrictRawClipboard: true,
+  restrictRawRandomUuid: true,
   /**
    * The governed escape hatch (the frontend analog of the backend's `# arch-allow-*`): a
    * justified `// terp-allow-<rule>: <reason>` comment on (or immediately above) a violating