@terpjs/spec 0.14.0

package/corpus/backend/input_schemas_exclude_managed_columns/violation-02/expected-findings.json

@@ -0,0 +1,12 @@
+[
+  {
+    "rule": "backend/input_schemas_exclude_managed_columns",
+    "path": "modules/notes/router.py",
+    "line": 7
+  },
+  {
+    "rule": "backend/input_schemas_exclude_managed_columns",
+    "path": "modules/notes/router.py",
+    "line": 8
+  }
+]

package/corpus/backend/input_schemas_exclude_managed_columns/violation-02/modules/notes/router.py

@@ -0,0 +1,14 @@
+import uuid
+
+from terp.core import BaseSchema
+
+
+class NotePayload(BaseSchema):
+    owner_id: uuid.UUID
+    tenant_id: uuid.UUID
+    title: str
+
+
+@router.post('/', response_model=NoteRead)
+def create_note(payload: NotePayload) -> NoteRead:
+    return NoteRead()

package/corpus/backend/input_str_fields_have_max_length/compliant-01/modules/notes/schemas.py

@@ -0,0 +1,4 @@
+class NoteCreate(BaseSchema):
+    title: str = Field(max_length=200)
+class NoteRead(BaseSchema):
+    title: str

package/corpus/backend/input_str_fields_have_max_length/violation-01/modules/notes/schemas.py

@@ -0,0 +1,2 @@
+class NoteCreate(BaseSchema):
+    title: str

package/corpus/backend/jobs_reference_catalog/compliant-01/modules/notes/service.py

@@ -0,0 +1,5 @@
+from control_plane.jobs import NOTES_REINDEX
+
+
+def request_reindex(session, note_id):
+    enqueue(session, job=NOTES_REINDEX, payload={"note_id": note_id})

package/corpus/backend/jobs_reference_catalog/violation-01/modules/notes/service.py

@@ -0,0 +1,2 @@
+def request_reindex(session, note_id):
+    enqueue(session, job="notes.reindex", payload={"note_id": note_id})

package/corpus/backend/list_routes_paginate/compliant-01/modules/notes/router.py

@@ -0,0 +1,6 @@
+@router.get('/', response_model=Page[NoteRead])
+def list_notes() -> Page[NoteRead]:
+    return Page()
+@router.get('/{x}', response_model=NoteRead)
+def get_note(x) -> NoteRead:
+    return NoteRead()

package/corpus/backend/list_routes_paginate/violation-01/modules/notes/router.py

@@ -0,0 +1,3 @@
+@router.get('/', response_model=list[NoteRead])
+def list_notes() -> list[NoteRead]:
+    return []

package/corpus/backend/modules_declare_policy/compliant-01/modules/notes/module.py

@@ -0,0 +1,7 @@
+from terp.core import ModuleSpec, Policy, Roles
+
+spec = ModuleSpec(
+    name="notes",
+    router=router,
+    policy=Policy(read=Roles.VIEWER, write=Roles.EDITOR),
+)

package/corpus/backend/modules_declare_policy/violation-01/modules/notes/module.py

@@ -0,0 +1,6 @@
+from terp.core import ModuleSpec
+
+spec = ModuleSpec(
+    name="notes",
+    router=router,
+)

package/corpus/backend/mutations_emit_audit/compliant-01/modules/notes/service.py

@@ -0,0 +1,9 @@
+from terp.core import BaseService
+
+
+class NoteService(BaseService):
+    model = Note
+
+    def archive(self, session, note_id, payload):
+        note = self.get(session, note_id)
+        return self.update(session, note, payload)

package/corpus/backend/mutations_emit_audit/violation-01/modules/notes/service.py

@@ -0,0 +1,4 @@
+def archive_note(session, note):
+    note.archived = True
+    session.add(note)
+    session.commit()

package/corpus/backend/mutations_require_write_role/compliant-01/modules/notes/module.py

@@ -0,0 +1,7 @@
+from terp.core import ModuleSpec, Policy, Roles
+
+spec = ModuleSpec(
+    name="notes",
+    router=router,
+    policy=Policy(read=Roles.VIEWER, write=Roles.EDITOR),
+)

package/corpus/backend/mutations_require_write_role/compliant-01/modules/notes/router.py

@@ -0,0 +1,3 @@
+@router.post('/', response_model=NoteRead)
+def create_note(payload) -> NoteRead:
+    return NoteRead()

package/corpus/backend/mutations_require_write_role/compliant-02/modules/notes/module.py

@@ -0,0 +1,7 @@
+from terp.core import ModuleSpec, Policy
+
+spec = ModuleSpec(
+    name="notes",
+    router=router,
+    policy=Policy.default(),
+)

package/corpus/backend/mutations_require_write_role/compliant-02/modules/notes/router.py

@@ -0,0 +1,3 @@
+@router.post('/', response_model=NoteRead)
+def create_note(payload) -> NoteRead:
+    return NoteRead()

package/corpus/backend/mutations_require_write_role/violation-01/expected-findings.json

@@ -0,0 +1,7 @@
+[
+  {
+    "rule": "backend/mutations_require_write_role",
+    "path": "modules/notes/module.py",
+    "line": 6
+  }
+]

package/corpus/backend/mutations_require_write_role/violation-01/modules/notes/module.py

@@ -0,0 +1,7 @@
+from terp.core import ModuleSpec, Policy, Roles
+
+spec = ModuleSpec(
+    name="notes",
+    router=router,
+    policy=Policy(read=Roles.VIEWER, write=Roles.VIEWER),
+)

package/corpus/backend/mutations_require_write_role/violation-01/modules/notes/router.py

@@ -0,0 +1,3 @@
+@router.post('/', response_model=NoteRead)
+def create_note(payload) -> NoteRead:
+    return NoteRead()

package/corpus/backend/mutations_require_write_role/violation-02/expected-findings.json

@@ -0,0 +1,7 @@
+[
+  {
+    "rule": "backend/mutations_require_write_role",
+    "path": "modules/notes/module.py",
+    "line": 6
+  }
+]

package/corpus/backend/mutations_require_write_role/violation-02/modules/notes/module.py

@@ -0,0 +1,7 @@
+from terp.core import ModuleSpec, Policy, Roles
+
+spec = ModuleSpec(
+    name="notes",
+    router=router,
+    policy=Policy(read=Roles.ADMIN),
+)

package/corpus/backend/mutations_require_write_role/violation-02/modules/notes/router.py

@@ -0,0 +1,5 @@
+def create_note(payload) -> NoteRead:
+    return NoteRead()
+
+
+router.add_api_route("/", create_note, methods=["POST"])

package/corpus/backend/mutations_require_write_role/violation-03/expected-findings.json

@@ -0,0 +1,7 @@
+[
+  {
+    "rule": "backend/mutations_require_write_role",
+    "path": "modules/notes/module.py",
+    "line": 8
+  }
+]

package/corpus/backend/mutations_require_write_role/violation-03/modules/notes/module.py

@@ -0,0 +1,10 @@
+from terp.core import ModuleSpec, Policy, Roles
+
+spec = ModuleSpec(
+    name="notes",
+    router=router,
+    policy=Policy(
+        read=Roles.ADMIN,
+        write=Roles.EDITOR,
+    ),
+)

package/corpus/backend/mutations_require_write_role/violation-03/modules/notes/router.py

@@ -0,0 +1,3 @@
+@router.patch('/{note_id}', response_model=NoteRead)
+def update_note(note_id, payload) -> NoteRead:
+    return NoteRead()

package/corpus/backend/no_adhoc_background_runtime/compliant-01/modules/notes/service.py

@@ -0,0 +1,9 @@
+from threading import RLock
+
+from terp.core import enqueue
+
+_lock = RLock()
+
+
+def export_notes():
+    enqueue('notes.export', {})

package/corpus/backend/no_adhoc_background_runtime/violation-01/modules/notes/service.py

@@ -0,0 +1,5 @@
+import threading
+
+
+def export_notes():
+    threading.Thread(target=print).start()

package/corpus/backend/no_adhoc_background_runtime/violation-02/modules/notes/service.py

@@ -0,0 +1,3 @@
+from celery import Celery
+
+worker = Celery('notes')

package/corpus/backend/no_adhoc_config_decrypt/compliant-01/modules/billing/service.py

@@ -0,0 +1,2 @@
+def shown() -> str:
+    return mask_config(settings.DB_DSN)

package/corpus/backend/no_adhoc_config_decrypt/violation-01/modules/billing/service.py

@@ -0,0 +1,2 @@
+def dsn() -> str:
+    return decrypt_config(settings.DB_DSN)

package/corpus/backend/no_adhoc_logging_config/compliant-01/modules/notes/service.py

@@ -0,0 +1,3 @@
+import logging
+
+logger = logging.getLogger(__name__)

package/corpus/backend/no_adhoc_logging_config/violation-01/modules/notes/service.py

@@ -0,0 +1,3 @@
+import logging
+
+logging.basicConfig(level='INFO')

package/corpus/backend/no_adhoc_middleware/compliant-01/main.py

@@ -0,0 +1,3 @@
+from terp.core import SecurityConfig, create_app
+
+app = create_app(modules=[], security=SecurityConfig())

package/corpus/backend/no_adhoc_middleware/violation-01/main.py

@@ -0,0 +1,4 @@
+from terp.core import create_app
+
+app = create_app(modules=[])
+app.add_middleware(object)

package/corpus/backend/no_adhoc_middleware/violation-02/main.py

@@ -0,0 +1,5 @@
+from starlette.middleware.base import BaseHTTPMiddleware
+
+
+class TimingMiddleware(BaseHTTPMiddleware):
+    pass

package/corpus/backend/no_adhoc_permission_literals/compliant-01/modules/notes/module.py

@@ -0,0 +1,3 @@
+from app.control_plane.permissions import NOTES_WRITE
+
+spec = ModuleSpec(name='notes', policy=Policy(write=NOTES_WRITE))

package/corpus/backend/no_adhoc_permission_literals/compliant-02/modules/notes/router.py

@@ -0,0 +1,5 @@
+from app.control_plane.permissions import NOTES_DELETE
+
+
+def remove_note(principal):
+    require_permission(NOTES_DELETE, principal)

package/corpus/backend/no_adhoc_permission_literals/violation-01/expected-findings.json

@@ -0,0 +1,7 @@
+[
+  {
+    "rule": "backend/no_adhoc_permission_literals",
+    "path": "modules/notes/module.py",
+    "line": 1
+  }
+]

package/corpus/backend/no_adhoc_permission_literals/violation-01/modules/notes/module.py

@@ -0,0 +1 @@
+spec = ModuleSpec(name='notes', policy=Policy(write='notes:write'))

package/corpus/backend/no_adhoc_permission_literals/violation-02/expected-findings.json

@@ -0,0 +1,7 @@
+[
+  {
+    "rule": "backend/no_adhoc_permission_literals",
+    "path": "modules/notes/router.py",
+    "line": 2
+  }
+]

package/corpus/backend/no_adhoc_permission_literals/violation-02/modules/notes/router.py

@@ -0,0 +1,2 @@
+def delete_note(principal):
+    require_permission('notes:delete', principal)

package/corpus/backend/no_adhoc_permission_literals/violation-03/expected-findings.json

@@ -0,0 +1,12 @@
+[
+  {
+    "rule": "backend/no_adhoc_permission_literals",
+    "path": "modules/notes/module.py",
+    "line": 7
+  },
+  {
+    "rule": "backend/no_adhoc_permission_literals",
+    "path": "modules/notes/module.py",
+    "line": 8
+  }
+]

package/corpus/backend/no_adhoc_permission_literals/violation-03/modules/notes/module.py

@@ -0,0 +1,10 @@
+from terp.core import ModuleSpec, Policy
+
+spec = ModuleSpec(
+    name="notes",
+    router=router,
+    policy=Policy(
+        read="notes:read",
+        write_role="editor",
+    ),
+)

package/corpus/backend/no_app_instantiation/compliant-01/main.py

@@ -0,0 +1,3 @@
+from terp.core import create_app
+
+app = create_app(modules=[])

package/corpus/backend/no_app_instantiation/violation-01/main.py

@@ -0,0 +1,3 @@
+from fastapi import FastAPI
+
+app = FastAPI(title='notes')

package/corpus/backend/no_blocking_sleep/compliant-01/modules/notes/service.py

@@ -0,0 +1,2 @@
+def run(worker):
+    worker.wait_for_completion()

package/corpus/backend/no_blocking_sleep/violation-01/modules/notes/service.py

@@ -0,0 +1,5 @@
+import time
+
+
+def run():
+    time.sleep(1)

package/corpus/backend/no_cross_module_imports/compliant-01/modules/a/service.py

@@ -0,0 +1 @@
+from terp.core import BaseService

package/corpus/backend/no_cross_module_imports/violation-01/modules/a/service.py

@@ -0,0 +1 @@
+from app.modules.b.models import Thing

package/corpus/backend/no_cross_module_imports/violation-02/modules/a/service.py

@@ -0,0 +1 @@
+from ..b.service import TaskService

package/corpus/backend/no_dependency_overrides/compliant-01/main.py

@@ -0,0 +1,12 @@
+"""Compliant: the composition root wires seams through create_app only."""
+
+from terp.core import create_app
+
+from app.auth import principal_provider
+
+
+def build():
+    return create_app([], principal_provider=principal_provider)
+
+
+app = build()

package/corpus/backend/no_dependency_overrides/violation-01/main.py

@@ -0,0 +1,11 @@
+"""Violation: rebinding the principal seam disables authentication app-wide."""
+
+from terp.core import create_app, get_principal
+
+
+def build():
+    return create_app([])
+
+
+app = build()
+app.dependency_overrides[get_principal] = lambda: None

package/corpus/backend/no_destructive_migrations/compliant-01/modules/notes/migrations/versions/0001_change.py

@@ -0,0 +1,3 @@
+def upgrade():
+    op.add_column('notes', column)
+    op.alter_column('notes', 'title', nullable=False)

package/corpus/backend/no_destructive_migrations/compliant-02/modules/notes/migrations/versions/0001_change.py

@@ -0,0 +1,8 @@
+def downgrade():
+    op.drop_table('notes')
+
+
+def upgrade():
+    op.execute("UPDATE notes SET title = 'untitled' WHERE title IS NULL")
+    op.execute('DROP INDEX ix_notes_title')
+    op.alter_column('notes', 'title', nullable=True)

package/corpus/backend/no_destructive_migrations/violation-01/expected-findings.json

@@ -0,0 +1,7 @@
+[
+  {
+    "rule": "backend/no_destructive_migrations",
+    "path": "modules/notes/migrations/versions/0001_change.py",
+    "line": 2
+  }
+]

package/corpus/backend/no_destructive_migrations/violation-01/modules/notes/migrations/versions/0001_change.py

@@ -0,0 +1,2 @@
+def upgrade():
+    op.drop_table('notes')

package/corpus/backend/no_destructive_migrations/violation-02/expected-findings.json

@@ -0,0 +1,7 @@
+[
+  {
+    "rule": "backend/no_destructive_migrations",
+    "path": "modules/notes/migrations/versions/0001_change.py",
+    "line": 2
+  }
+]

package/corpus/backend/no_destructive_migrations/violation-02/modules/notes/migrations/versions/0001_change.py

@@ -0,0 +1,2 @@
+def upgrade():
+    op.execute('DROP TABLE notes')

package/corpus/backend/no_destructive_migrations/violation-03/expected-findings.json

@@ -0,0 +1,7 @@
+[
+  {
+    "rule": "backend/no_destructive_migrations",
+    "path": "modules/notes/migrations/versions/0001_change.py",
+    "line": 3
+  }
+]

package/corpus/backend/no_destructive_migrations/violation-03/modules/notes/migrations/versions/0001_change.py

@@ -0,0 +1,3 @@
+# terp-allow-destructive-migration: the pre-0.6.0 bespoke file-level waiver is retired
+def upgrade():
+    op.drop_table('notes_beta')

package/corpus/backend/no_destructive_migrations/violation-04/expected-findings.json

@@ -0,0 +1,12 @@
+[
+  {
+    "rule": "backend/no_destructive_migrations",
+    "path": "modules/notes/migrations/versions/0001_change.py",
+    "line": 5
+  },
+  {
+    "rule": "backend/no_destructive_migrations",
+    "path": "modules/notes/migrations/versions/0001_change.py",
+    "line": 6
+  }
+]

package/corpus/backend/no_destructive_migrations/violation-04/modules/notes/migrations/versions/0001_change.py

@@ -0,0 +1,6 @@
+import sqlalchemy as sa
+
+
+def upgrade():
+    op.drop_column('notes', 'legacy_flag')
+    op.alter_column('notes', 'title', type_=sa.Text())

package/corpus/backend/no_destructive_migrations/violation-05/expected-findings.json

@@ -0,0 +1,12 @@
+[
+  {
+    "rule": "backend/no_destructive_migrations",
+    "path": "modules/notes/migrations/versions/0001_change.py",
+    "line": 2
+  },
+  {
+    "rule": "backend/no_destructive_migrations",
+    "path": "modules/notes/migrations/versions/0001_change.py",
+    "line": 3
+  }
+]

package/corpus/backend/no_destructive_migrations/violation-05/modules/notes/migrations/versions/0001_change.py

@@ -0,0 +1,3 @@
+def upgrade():
+    op.execute('DELETE FROM notes WHERE deleted_at IS NOT NULL')
+    op.execute('TRUNCATE TABLE notes_audit')

package/corpus/backend/no_dynamic_sql/compliant-01/modules/notes/service.py

@@ -0,0 +1 @@
+stmt = text('SELECT * FROM notes WHERE id=:id')

package/corpus/backend/no_dynamic_sql/compliant-02/modules/notes/service.py

@@ -0,0 +1,20 @@
+"""Compliant near-misses: static SQL that merely LOOKS dynamic must stay clean.
+
+* adjacent string literals merge into one static literal at parse time — that is
+  juxtaposition, not concatenation;
+* a comment or a plain string mentioning ``text(f"...")`` is not a call;
+* parameters bind data without building SQL.
+"""
+
+from sqlalchemy import text
+
+# text(f"SELECT * FROM notes WHERE id={note_id}") in a comment must not fire.
+GUIDE = 'never call text(f"SELECT ...") — bind parameters instead'
+
+
+def fetch(session, note_id):
+    stmt = text(
+        "SELECT id, title FROM notes "
+        "WHERE id = :id AND deleted_at IS NULL"
+    )
+    return session.execute(stmt, {"id": note_id})

package/corpus/backend/no_dynamic_sql/violation-01/modules/notes/service.py

@@ -0,0 +1,2 @@
+def run(note_id):
+    return text(f'SELECT * FROM notes WHERE id={note_id}')

package/corpus/backend/no_dynamic_sql/violation-02/modules/notes/service.py

@@ -0,0 +1,2 @@
+def run(table_name):
+    return text('SELECT * FROM ' + table_name)

package/corpus/backend/no_dynamic_sql/violation-03/modules/notes/service.py

@@ -0,0 +1,7 @@
+"""Violation: attribute-qualified text() with .format() — qualification must not evade."""
+
+import sqlalchemy
+
+
+def find_all(session, table_name):
+    return session.execute(sqlalchemy.text("SELECT * FROM {}".format(table_name)))

package/corpus/backend/no_dynamic_sql/violation-04/modules/notes/service.py

@@ -0,0 +1,16 @@
+"""Violation: SQL built into a variable (multiline %-format) and passed to text().
+
+Deliberately session-free: the case must trigger only ``no_dynamic_sql`` (a
+``session.execute(text(...))`` receiver would additionally trip the
+``mutations_emit_audit`` smuggled-DML detection -- a different rule's concern).
+"""
+
+from sqlalchemy import text
+
+
+def build_search(term):
+    query = (
+        "SELECT id FROM notes "
+        "WHERE title LIKE '%%%s%%'" % term
+    )
+    return text(query)

package/corpus/backend/no_empty_tests/compliant-01/tests/test_notes.py

@@ -0,0 +1,2 @@
+def test_run():
+    assert 1 + 1 == 2

package/corpus/backend/no_empty_tests/violation-01/tests/test_notes.py

@@ -0,0 +1,2 @@
+def test_run():
+    pass

package/corpus/backend/no_eval_or_exec/compliant-01/modules/notes/service.py

@@ -0,0 +1,2 @@
+def run(payload):
+    return int(payload)

package/corpus/backend/no_eval_or_exec/violation-01/modules/notes/service.py

@@ -0,0 +1,2 @@
+def run(payload):
+    return eval(payload)

package/corpus/backend/no_hardcoded_credentials/compliant-01/modules/billing/service.py

@@ -0,0 +1,3 @@
+password = ''
+api_key = settings.API_KEY
+token = os.environ['TOKEN']

package/corpus/backend/no_hardcoded_credentials/compliant-02/modules/billing/service.py

@@ -0,0 +1,18 @@
+"""Compliant near-misses: credential-adjacent code that must stay clean.
+
+* a credential-shaped name is fine when the value is dynamic (env read) or not a
+  string (a numeric policy knob);
+* names that merely resemble the credential words (``passphrase_env``,
+  ``credentials_path``) are not in the shape list;
+* comments and truncated look-alike tokens are not secrets.
+"""
+
+import os
+
+token_kind = os.environ.get("TOKEN_KIND", "opaque")
+password_min_length = 12
+passphrase_env = "BILLING_PASSPHRASE"
+credentials_path = "/run/secrets/billing.json"
+
+# password = "hunter2" in a comment must not fire.
+EXAMPLE_DOC = "an AKIA_EXAMPLE_NOT_A_KEY placeholder is not a real AWS key id"

package/corpus/backend/no_hardcoded_credentials/violation-01/expected-findings.json

@@ -0,0 +1,7 @@
+[
+  {
+    "rule": "backend/no_hardcoded_credentials",
+    "path": "modules/billing/service.py",
+    "line": 2
+  }
+]

package/corpus/backend/no_hardcoded_credentials/violation-01/modules/billing/service.py

@@ -0,0 +1,2 @@
+def configure(self):
+    password = 'not-from-config'

package/corpus/backend/no_hardcoded_credentials/violation-02/expected-findings.json

@@ -0,0 +1,7 @@
+[
+  {
+    "rule": "backend/no_hardcoded_credentials",
+    "path": "modules/billing/service.py",
+    "line": 1
+  }
+]

package/corpus/backend/no_hardcoded_credentials/violation-02/modules/billing/service.py

@@ -0,0 +1 @@
+client_secret = 'not-from-config'

package/corpus/backend/no_hardcoded_credentials/violation-03/expected-findings.json

@@ -0,0 +1,22 @@
+[
+  {
+    "rule": "backend/no_hardcoded_credentials",
+    "path": "modules/billing/service.py",
+    "line": 5
+  },
+  {
+    "rule": "backend/no_hardcoded_credentials",
+    "path": "modules/billing/service.py",
+    "line": 8
+  },
+  {
+    "rule": "backend/no_hardcoded_credentials",
+    "path": "modules/billing/service.py",
+    "line": 11
+  },
+  {
+    "rule": "backend/no_hardcoded_credentials",
+    "path": "modules/billing/service.py",
+    "line": 11
+  }
+]