@terpjs/spec 0.14.0 → 0.16.0

package/corpus/backend/no_adhoc_permission_literals/violation-03/modules/notes/module.py

@@ -1,10 +1,10 @@
-from terp.core import ModuleSpec, Policy
-
-spec = ModuleSpec(
-    name="notes",
-    router=router,
-    policy=Policy(
-        read="notes:read",
-        write_role="editor",
-    ),
-)
+from terp.core import ModuleSpec, Policy
+
+spec = ModuleSpec(
+    name="notes",
+    router=router,
+    policy=Policy(
+        read="notes:read",
+        write_role="editor",
+    ),
+)

package/corpus/backend/no_app_instantiation/compliant-01/main.py

@@ -1,3 +1,3 @@
-from terp.core import create_app
-
-app = create_app(modules=[])
+from terp.core import create_app
+
+app = create_app(modules=[])

package/corpus/backend/no_app_instantiation/violation-01/main.py

@@ -1,3 +1,3 @@
-from fastapi import FastAPI
-
-app = FastAPI(title='notes')
+from fastapi import FastAPI
+
+app = FastAPI(title='notes')

package/corpus/backend/no_blocking_sleep/compliant-01/modules/notes/service.py

@@ -1,2 +1,2 @@
-def run(worker):
-    worker.wait_for_completion()
+def run(worker):
+    worker.wait_for_completion()

package/corpus/backend/no_blocking_sleep/violation-01/modules/notes/service.py

@@ -1,5 +1,5 @@
-import time
-
-
-def run():
-    time.sleep(1)
+import time
+
+
+def run():
+    time.sleep(1)

package/corpus/backend/no_cross_module_imports/compliant-01/modules/a/service.py

@@ -1 +1 @@
-from terp.core import BaseService
+from terp.core import BaseService

package/corpus/backend/no_cross_module_imports/violation-01/modules/a/service.py

@@ -1 +1 @@
-from app.modules.b.models import Thing
+from app.modules.b.models import Thing

package/corpus/backend/no_cross_module_imports/violation-02/modules/a/service.py

@@ -1 +1 @@
-from ..b.service import TaskService
+from ..b.service import TaskService

package/corpus/backend/no_dependency_overrides/compliant-01/main.py

@@ -1,12 +1,12 @@
-"""Compliant: the composition root wires seams through create_app only."""
-
-from terp.core import create_app
-
-from app.auth import principal_provider
-
-
-def build():
-    return create_app([], principal_provider=principal_provider)
-
-
-app = build()
+"""Compliant: the composition root wires seams through create_app only."""
+
+from terp.core import create_app
+
+from app.auth import principal_provider
+
+
+def build():
+    return create_app([], principal_provider=principal_provider)
+
+
+app = build()

package/corpus/backend/no_dependency_overrides/violation-01/main.py

@@ -1,11 +1,11 @@
-"""Violation: rebinding the principal seam disables authentication app-wide."""
-
-from terp.core import create_app, get_principal
-
-
-def build():
-    return create_app([])
-
-
-app = build()
-app.dependency_overrides[get_principal] = lambda: None
+"""Violation: rebinding the principal seam disables authentication app-wide."""
+
+from terp.core import create_app, get_principal
+
+
+def build():
+    return create_app([])
+
+
+app = build()
+app.dependency_overrides[get_principal] = lambda: None

package/corpus/backend/no_destructive_migrations/compliant-01/modules/notes/migrations/versions/0001_change.py

@@ -1,3 +1,3 @@
-def upgrade():
-    op.add_column('notes', column)
-    op.alter_column('notes', 'title', nullable=False)
+def upgrade():
+    op.add_column('notes', column)
+    op.alter_column('notes', 'title', nullable=False)

package/corpus/backend/no_destructive_migrations/compliant-02/modules/notes/migrations/versions/0001_change.py

@@ -1,8 +1,8 @@
-def downgrade():
-    op.drop_table('notes')
-
-
-def upgrade():
-    op.execute("UPDATE notes SET title = 'untitled' WHERE title IS NULL")
-    op.execute('DROP INDEX ix_notes_title')
-    op.alter_column('notes', 'title', nullable=True)
+def downgrade():
+    op.drop_table('notes')
+
+
+def upgrade():
+    op.execute("UPDATE notes SET title = 'untitled' WHERE title IS NULL")
+    op.execute('DROP INDEX ix_notes_title')
+    op.alter_column('notes', 'title', nullable=True)

package/corpus/backend/no_destructive_migrations/violation-01/expected-findings.json

@@ -1,7 +1,7 @@
-[
-  {
-    "rule": "backend/no_destructive_migrations",
-    "path": "modules/notes/migrations/versions/0001_change.py",
-    "line": 2
-  }
-]
+[
+  {
+    "rule": "backend/no_destructive_migrations",
+    "path": "modules/notes/migrations/versions/0001_change.py",
+    "line": 2
+  }
+]

package/corpus/backend/no_destructive_migrations/violation-01/modules/notes/migrations/versions/0001_change.py

@@ -1,2 +1,2 @@
-def upgrade():
-    op.drop_table('notes')
+def upgrade():
+    op.drop_table('notes')

package/corpus/backend/no_destructive_migrations/violation-02/expected-findings.json

@@ -1,7 +1,7 @@
-[
-  {
-    "rule": "backend/no_destructive_migrations",
-    "path": "modules/notes/migrations/versions/0001_change.py",
-    "line": 2
-  }
-]
+[
+  {
+    "rule": "backend/no_destructive_migrations",
+    "path": "modules/notes/migrations/versions/0001_change.py",
+    "line": 2
+  }
+]

package/corpus/backend/no_destructive_migrations/violation-02/modules/notes/migrations/versions/0001_change.py

@@ -1,2 +1,2 @@
-def upgrade():
-    op.execute('DROP TABLE notes')
+def upgrade():
+    op.execute('DROP TABLE notes')

package/corpus/backend/no_destructive_migrations/violation-03/expected-findings.json

@@ -1,7 +1,7 @@
-[
-  {
-    "rule": "backend/no_destructive_migrations",
-    "path": "modules/notes/migrations/versions/0001_change.py",
-    "line": 3
-  }
-]
+[
+  {
+    "rule": "backend/no_destructive_migrations",
+    "path": "modules/notes/migrations/versions/0001_change.py",
+    "line": 3
+  }
+]

package/corpus/backend/no_destructive_migrations/violation-03/modules/notes/migrations/versions/0001_change.py

@@ -1,3 +1,3 @@
-# terp-allow-destructive-migration: the pre-0.6.0 bespoke file-level waiver is retired
-def upgrade():
-    op.drop_table('notes_beta')
+# terp-allow-destructive-migration: the pre-0.6.0 bespoke file-level waiver is retired
+def upgrade():
+    op.drop_table('notes_beta')

package/corpus/backend/no_destructive_migrations/violation-04/expected-findings.json

@@ -1,12 +1,12 @@
-[
-  {
-    "rule": "backend/no_destructive_migrations",
-    "path": "modules/notes/migrations/versions/0001_change.py",
-    "line": 5
-  },
-  {
-    "rule": "backend/no_destructive_migrations",
-    "path": "modules/notes/migrations/versions/0001_change.py",
-    "line": 6
-  }
-]
+[
+  {
+    "rule": "backend/no_destructive_migrations",
+    "path": "modules/notes/migrations/versions/0001_change.py",
+    "line": 5
+  },
+  {
+    "rule": "backend/no_destructive_migrations",
+    "path": "modules/notes/migrations/versions/0001_change.py",
+    "line": 6
+  }
+]

package/corpus/backend/no_destructive_migrations/violation-04/modules/notes/migrations/versions/0001_change.py

@@ -1,6 +1,6 @@
-import sqlalchemy as sa
-
-
-def upgrade():
-    op.drop_column('notes', 'legacy_flag')
-    op.alter_column('notes', 'title', type_=sa.Text())
+import sqlalchemy as sa
+
+
+def upgrade():
+    op.drop_column('notes', 'legacy_flag')
+    op.alter_column('notes', 'title', type_=sa.Text())

package/corpus/backend/no_destructive_migrations/violation-05/expected-findings.json

@@ -1,12 +1,12 @@
-[
-  {
-    "rule": "backend/no_destructive_migrations",
-    "path": "modules/notes/migrations/versions/0001_change.py",
-    "line": 2
-  },
-  {
-    "rule": "backend/no_destructive_migrations",
-    "path": "modules/notes/migrations/versions/0001_change.py",
-    "line": 3
-  }
-]
+[
+  {
+    "rule": "backend/no_destructive_migrations",
+    "path": "modules/notes/migrations/versions/0001_change.py",
+    "line": 2
+  },
+  {
+    "rule": "backend/no_destructive_migrations",
+    "path": "modules/notes/migrations/versions/0001_change.py",
+    "line": 3
+  }
+]

package/corpus/backend/no_destructive_migrations/violation-05/modules/notes/migrations/versions/0001_change.py

@@ -1,3 +1,3 @@
-def upgrade():
-    op.execute('DELETE FROM notes WHERE deleted_at IS NOT NULL')
-    op.execute('TRUNCATE TABLE notes_audit')
+def upgrade():
+    op.execute('DELETE FROM notes WHERE deleted_at IS NOT NULL')
+    op.execute('TRUNCATE TABLE notes_audit')

package/corpus/backend/no_dynamic_sql/compliant-01/modules/notes/service.py

@@ -1 +1 @@
-stmt = text('SELECT * FROM notes WHERE id=:id')
+stmt = text('SELECT * FROM notes WHERE id=:id')

package/corpus/backend/no_dynamic_sql/compliant-02/modules/notes/service.py

@@ -1,20 +1,20 @@
-"""Compliant near-misses: static SQL that merely LOOKS dynamic must stay clean.
-
-* adjacent string literals merge into one static literal at parse time — that is
-  juxtaposition, not concatenation;
-* a comment or a plain string mentioning ``text(f"...")`` is not a call;
-* parameters bind data without building SQL.
-"""
-
-from sqlalchemy import text
-
-# text(f"SELECT * FROM notes WHERE id={note_id}") in a comment must not fire.
-GUIDE = 'never call text(f"SELECT ...") — bind parameters instead'
-
-
-def fetch(session, note_id):
-    stmt = text(
-        "SELECT id, title FROM notes "
-        "WHERE id = :id AND deleted_at IS NULL"
-    )
-    return session.execute(stmt, {"id": note_id})
+"""Compliant near-misses: static SQL that merely LOOKS dynamic must stay clean.
+
+* adjacent string literals merge into one static literal at parse time — that is
+  juxtaposition, not concatenation;
+* a comment or a plain string mentioning ``text(f"...")`` is not a call;
+* parameters bind data without building SQL.
+"""
+
+from sqlalchemy import text
+
+# text(f"SELECT * FROM notes WHERE id={note_id}") in a comment must not fire.
+GUIDE = 'never call text(f"SELECT ...") — bind parameters instead'
+
+
+def fetch(session, note_id):
+    stmt = text(
+        "SELECT id, title FROM notes "
+        "WHERE id = :id AND deleted_at IS NULL"
+    )
+    return session.execute(stmt, {"id": note_id})

package/corpus/backend/no_dynamic_sql/violation-01/modules/notes/service.py

@@ -1,2 +1,2 @@
-def run(note_id):
-    return text(f'SELECT * FROM notes WHERE id={note_id}')
+def run(note_id):
+    return text(f'SELECT * FROM notes WHERE id={note_id}')

package/corpus/backend/no_dynamic_sql/violation-02/modules/notes/service.py

@@ -1,2 +1,2 @@
-def run(table_name):
-    return text('SELECT * FROM ' + table_name)
+def run(table_name):
+    return text('SELECT * FROM ' + table_name)

package/corpus/backend/no_dynamic_sql/violation-03/modules/notes/service.py

@@ -1,7 +1,7 @@
-"""Violation: attribute-qualified text() with .format() — qualification must not evade."""
-
-import sqlalchemy
-
-
-def find_all(session, table_name):
-    return session.execute(sqlalchemy.text("SELECT * FROM {}".format(table_name)))
+"""Violation: attribute-qualified text() with .format() — qualification must not evade."""
+
+import sqlalchemy
+
+
+def find_all(session, table_name):
+    return session.execute(sqlalchemy.text("SELECT * FROM {}".format(table_name)))

package/corpus/backend/no_dynamic_sql/violation-04/modules/notes/service.py

@@ -1,16 +1,16 @@
-"""Violation: SQL built into a variable (multiline %-format) and passed to text().
-
-Deliberately session-free: the case must trigger only ``no_dynamic_sql`` (a
-``session.execute(text(...))`` receiver would additionally trip the
-``mutations_emit_audit`` smuggled-DML detection -- a different rule's concern).
-"""
-
-from sqlalchemy import text
-
-
-def build_search(term):
-    query = (
-        "SELECT id FROM notes "
-        "WHERE title LIKE '%%%s%%'" % term
-    )
-    return text(query)
+"""Violation: SQL built into a variable (multiline %-format) and passed to text().
+
+Deliberately session-free: the case must trigger only ``no_dynamic_sql`` (a
+``session.execute(text(...))`` receiver would additionally trip the
+``mutations_emit_audit`` smuggled-DML detection -- a different rule's concern).
+"""
+
+from sqlalchemy import text
+
+
+def build_search(term):
+    query = (
+        "SELECT id FROM notes "
+        "WHERE title LIKE '%%%s%%'" % term
+    )
+    return text(query)

package/corpus/backend/no_empty_tests/compliant-01/tests/test_notes.py

@@ -1,2 +1,2 @@
-def test_run():
-    assert 1 + 1 == 2
+def test_run():
+    assert 1 + 1 == 2

package/corpus/backend/no_empty_tests/violation-01/tests/test_notes.py

@@ -1,2 +1,2 @@
-def test_run():
-    pass
+def test_run():
+    pass

package/corpus/backend/no_eval_or_exec/compliant-01/modules/notes/service.py

@@ -1,2 +1,2 @@
-def run(payload):
-    return int(payload)
+def run(payload):
+    return int(payload)

package/corpus/backend/no_eval_or_exec/violation-01/modules/notes/service.py

@@ -1,2 +1,2 @@
-def run(payload):
-    return eval(payload)
+def run(payload):
+    return eval(payload)

package/corpus/backend/no_hardcoded_credentials/compliant-01/modules/billing/service.py

@@ -1,3 +1,3 @@
-password = ''
-api_key = settings.API_KEY
-token = os.environ['TOKEN']
+password = ''
+api_key = settings.API_KEY
+token = os.environ['TOKEN']

package/corpus/backend/no_hardcoded_credentials/compliant-02/modules/billing/service.py

@@ -1,18 +1,18 @@
-"""Compliant near-misses: credential-adjacent code that must stay clean.
-
-* a credential-shaped name is fine when the value is dynamic (env read) or not a
-  string (a numeric policy knob);
-* names that merely resemble the credential words (``passphrase_env``,
-  ``credentials_path``) are not in the shape list;
-* comments and truncated look-alike tokens are not secrets.
-"""
-
-import os
-
-token_kind = os.environ.get("TOKEN_KIND", "opaque")
-password_min_length = 12
-passphrase_env = "BILLING_PASSPHRASE"
-credentials_path = "/run/secrets/billing.json"
-
-# password = "hunter2" in a comment must not fire.
-EXAMPLE_DOC = "an AKIA_EXAMPLE_NOT_A_KEY placeholder is not a real AWS key id"
+"""Compliant near-misses: credential-adjacent code that must stay clean.
+
+* a credential-shaped name is fine when the value is dynamic (env read) or not a
+  string (a numeric policy knob);
+* names that merely resemble the credential words (``passphrase_env``,
+  ``credentials_path``) are not in the shape list;
+* comments and truncated look-alike tokens are not secrets.
+"""
+
+import os
+
+token_kind = os.environ.get("TOKEN_KIND", "opaque")
+password_min_length = 12
+passphrase_env = "BILLING_PASSPHRASE"
+credentials_path = "/run/secrets/billing.json"
+
+# password = "hunter2" in a comment must not fire.
+EXAMPLE_DOC = "an AKIA_EXAMPLE_NOT_A_KEY placeholder is not a real AWS key id"

package/corpus/backend/no_hardcoded_credentials/violation-01/expected-findings.json

@@ -1,7 +1,7 @@
-[
-  {
-    "rule": "backend/no_hardcoded_credentials",
-    "path": "modules/billing/service.py",
-    "line": 2
-  }
-]
+[
+  {
+    "rule": "backend/no_hardcoded_credentials",
+    "path": "modules/billing/service.py",
+    "line": 2
+  }
+]

package/corpus/backend/no_hardcoded_credentials/violation-01/modules/billing/service.py

@@ -1,2 +1,2 @@
-def configure(self):
-    password = 'not-from-config'
+def configure(self):
+    password = 'not-from-config'

package/corpus/backend/no_hardcoded_credentials/violation-02/expected-findings.json

@@ -1,7 +1,7 @@
-[
-  {
-    "rule": "backend/no_hardcoded_credentials",
-    "path": "modules/billing/service.py",
-    "line": 1
-  }
-]
+[
+  {
+    "rule": "backend/no_hardcoded_credentials",
+    "path": "modules/billing/service.py",
+    "line": 1
+  }
+]

package/corpus/backend/no_hardcoded_credentials/violation-02/modules/billing/service.py

@@ -1 +1 @@
-client_secret = 'not-from-config'
+client_secret = 'not-from-config'

package/corpus/backend/no_hardcoded_credentials/violation-03/expected-findings.json

@@ -1,22 +1,22 @@
-[
-  {
-    "rule": "backend/no_hardcoded_credentials",
-    "path": "modules/billing/service.py",
-    "line": 5
-  },
-  {
-    "rule": "backend/no_hardcoded_credentials",
-    "path": "modules/billing/service.py",
-    "line": 8
-  },
-  {
-    "rule": "backend/no_hardcoded_credentials",
-    "path": "modules/billing/service.py",
-    "line": 11
-  },
-  {
-    "rule": "backend/no_hardcoded_credentials",
-    "path": "modules/billing/service.py",
-    "line": 11
-  }
-]
+[
+  {
+    "rule": "backend/no_hardcoded_credentials",
+    "path": "modules/billing/service.py",
+    "line": 5
+  },
+  {
+    "rule": "backend/no_hardcoded_credentials",
+    "path": "modules/billing/service.py",
+    "line": 8
+  },
+  {
+    "rule": "backend/no_hardcoded_credentials",
+    "path": "modules/billing/service.py",
+    "line": 11
+  },
+  {
+    "rule": "backend/no_hardcoded_credentials",
+    "path": "modules/billing/service.py",
+    "line": 11
+  }
+]

package/corpus/backend/no_hardcoded_credentials/violation-03/modules/billing/service.py

@@ -1,11 +1,11 @@
-"""Violation: credential-shaped targets beyond a plain name — attribute, annotated, chained."""
-
-
-class BillingClient:
-    api_key: str = "sk_live_1234567890"
-
-    def configure(self) -> None:
-        self._auth_token = "Bearer abc.def.ghi"
-
-
-password = admin_password = "hunter2"
+"""Violation: credential-shaped targets beyond a plain name — attribute, annotated, chained."""
+
+
+class BillingClient:
+    api_key: str = "sk_live_1234567890"
+
+    def configure(self) -> None:
+        self._auth_token = "Bearer abc.def.ghi"
+
+
+password = admin_password = "hunter2"

package/corpus/backend/no_hardcoded_credentials/violation-04/expected-findings.json

@@ -1,12 +1,12 @@
-[
-  {
-    "rule": "backend/no_hardcoded_credentials",
-    "path": "modules/billing/service.py",
-    "line": 3
-  },
-  {
-    "rule": "backend/no_hardcoded_credentials",
-    "path": "modules/billing/service.py",
-    "line": 5
-  }
-]
+[
+  {
+    "rule": "backend/no_hardcoded_credentials",
+    "path": "modules/billing/service.py",
+    "line": 3
+  },
+  {
+    "rule": "backend/no_hardcoded_credentials",
+    "path": "modules/billing/service.py",
+    "line": 5
+  }
+]

package/corpus/backend/no_hardcoded_credentials/violation-04/modules/billing/service.py

@@ -1,8 +1,8 @@
-"""Violation: high-confidence secret literals under bland names (format scan, not name scan)."""
-
-UPLOADER_NOTE = "temporary uploader key AKIAABCDEFGHIJKLMNOP"
-
-BACKUP_MATERIAL = """
------BEGIN RSA PRIVATE KEY-----
-MIIEow...
-"""
+"""Violation: high-confidence secret literals under bland names (format scan, not name scan)."""
+
+UPLOADER_NOTE = "temporary uploader key AKIAABCDEFGHIJKLMNOP"
+
+BACKUP_MATERIAL = """
+-----BEGIN RSA PRIVATE KEY-----
+MIIEow...
+"""