@terpjs/spec 0.14.0

package/corpus/backend/no_hardcoded_credentials/violation-03/modules/billing/service.py

@@ -0,0 +1,11 @@
+"""Violation: credential-shaped targets beyond a plain name — attribute, annotated, chained."""
+
+
+class BillingClient:
+    api_key: str = "sk_live_1234567890"
+
+    def configure(self) -> None:
+        self._auth_token = "Bearer abc.def.ghi"
+
+
+password = admin_password = "hunter2"

package/corpus/backend/no_hardcoded_credentials/violation-04/expected-findings.json

@@ -0,0 +1,12 @@
+[
+  {
+    "rule": "backend/no_hardcoded_credentials",
+    "path": "modules/billing/service.py",
+    "line": 3
+  },
+  {
+    "rule": "backend/no_hardcoded_credentials",
+    "path": "modules/billing/service.py",
+    "line": 5
+  }
+]

package/corpus/backend/no_hardcoded_credentials/violation-04/modules/billing/service.py

@@ -0,0 +1,8 @@
+"""Violation: high-confidence secret literals under bland names (format scan, not name scan)."""
+
+UPLOADER_NOTE = "temporary uploader key AKIAABCDEFGHIJKLMNOP"
+
+BACKUP_MATERIAL = """
+-----BEGIN RSA PRIVATE KEY-----
+MIIEow...
+"""

package/corpus/backend/no_hardcoded_credentials/violation-05/expected-findings.json

@@ -0,0 +1,12 @@
+[
+  {
+    "rule": "backend/no_hardcoded_credentials",
+    "path": "modules/billing/service.py",
+    "line": 2
+  },
+  {
+    "rule": "backend/no_hardcoded_credentials",
+    "path": "modules/billing/service.py",
+    "line": 3
+  }
+]

package/corpus/backend/no_hardcoded_credentials/violation-05/modules/billing/service.py

@@ -0,0 +1,4 @@
+def connect(config):
+    user, password = 'svc', 'hunter2'
+    header_value = 'ghp_0123456789abcdefghijklmnopqrstuvwxyz0123'
+    return user, header_value

package/corpus/backend/no_internal_imports/compliant-01/modules/notes/service.py

@@ -0,0 +1 @@
+from terp.core import BaseService

package/corpus/backend/no_internal_imports/violation-01/modules/notes/service.py

@@ -0,0 +1 @@
+from terp.core._internal.engine import get_engine

package/corpus/backend/no_manual_actor_stamping/compliant-01/modules/notes/service.py

@@ -0,0 +1,5 @@
+from terp.core import BaseService
+
+
+class NoteService(BaseService):
+    model = Note

package/corpus/backend/no_manual_actor_stamping/compliant-02/modules/notes/schemas.py

@@ -0,0 +1,12 @@
+import uuid
+
+from terp.core import BaseSchema
+
+
+class NoteRead(BaseSchema):
+    """A read DTO may EXPOSE the actor-stamp columns (annotation only) —
+    only attribute access (set / compare) is policed."""
+
+    title: str
+    created_by_id: uuid.UUID | None
+    modified_by_id: uuid.UUID | None

package/corpus/backend/no_manual_actor_stamping/violation-01/modules/notes/service.py

@@ -0,0 +1,3 @@
+def create_note(note, actor):
+    note.created_by_id = actor.id
+    note.modified_by_id = actor.id

package/corpus/backend/no_manual_actor_stamping/violation-02/expected-findings.json

@@ -0,0 +1,7 @@
+[
+  {
+    "rule": "backend/no_manual_actor_stamping",
+    "path": "modules/notes/service.py",
+    "line": 3
+  }
+]

package/corpus/backend/no_manual_actor_stamping/violation-02/modules/notes/service.py

@@ -0,0 +1,4 @@
+def import_note(note, source_row, actor):
+    note.title = source_row["title"]
+    note.created_by_id = actor.id
+    return note

package/corpus/backend/no_manual_ownership_checks/compliant-01/modules/journals/service.py

@@ -0,0 +1,3 @@
+from terp.core import BaseService
+class JournalService(BaseService):
+    model = Journal

package/corpus/backend/no_manual_ownership_checks/compliant-02/modules/journals/schemas.py

@@ -0,0 +1,11 @@
+import uuid
+
+from terp.core import BaseSchema
+
+
+class JournalRead(BaseSchema):
+    """A read DTO may EXPOSE owner_id (annotation only) — only attribute
+    access (set / filter / compare) is policed."""
+
+    title: str
+    owner_id: uuid.UUID | None

package/corpus/backend/no_manual_ownership_checks/violation-01/modules/journals/service.py

@@ -0,0 +1,3 @@
+def guard(entry, principal):
+    if entry.owner_id != principal.id:
+        raise PermissionDeniedError()

package/corpus/backend/no_manual_ownership_checks/violation-02/expected-findings.json

@@ -0,0 +1,7 @@
+[
+  {
+    "rule": "backend/no_manual_ownership_checks",
+    "path": "modules/journals/service.py",
+    "line": 7
+  }
+]

package/corpus/backend/no_manual_ownership_checks/violation-02/modules/journals/service.py

@@ -0,0 +1,9 @@
+from sqlmodel import select
+
+
+def entries_for(session, principal):
+    return session.exec(
+        select(Journal).where(
+            Journal.owner_id == principal.id,
+        )
+    ).all()

package/corpus/backend/no_manual_ownership_checks/violation-03/expected-findings.json

@@ -0,0 +1,7 @@
+[
+  {
+    "rule": "backend/no_manual_ownership_checks",
+    "path": "modules/notes/service.py",
+    "line": 6
+  }
+]

package/corpus/backend/no_manual_ownership_checks/violation-03/modules/notes/jobs.py

@@ -0,0 +1 @@
+PURGE_EXPIRED_NOTES = object()

package/corpus/backend/no_manual_ownership_checks/violation-03/modules/notes/models.py

@@ -0,0 +1,7 @@
+from sqlmodel import Field
+
+from terp.core import ActorStampedMixin, BaseTable
+
+
+class Note(BaseTable, ActorStampedMixin, table=True):
+    title: str = Field(max_length=200)

package/corpus/backend/no_manual_ownership_checks/violation-03/modules/notes/module.py

@@ -0,0 +1,11 @@
+from terp.core import ModuleSpec
+
+from .jobs import PURGE_EXPIRED_NOTES
+from .service import NoteService
+
+
+module = ModuleSpec(
+    name="notes",
+    services=(NoteService,),
+    jobs=(PURGE_EXPIRED_NOTES,),
+)

package/corpus/backend/no_manual_ownership_checks/violation-03/modules/notes/service.py

@@ -0,0 +1,7 @@
+from terp.core import BaseService
+
+from .models import Note
+
+
+class NoteService(BaseService):
+    model = Note

package/corpus/backend/no_manual_scope_filtering/compliant-01/modules/notes/service.py

@@ -0,0 +1,8 @@
+from terp.core import BaseService
+
+
+class NoteService(BaseService):
+    model = Note
+
+    def visible(self, session):
+        return session.exec(self.base_query())

package/corpus/backend/no_manual_scope_filtering/compliant-02/modules/notes/schemas.py

@@ -0,0 +1,12 @@
+import datetime
+
+from terp.core import BaseSchema
+
+
+class NoteRead(BaseSchema):
+    """A read DTO may EXPOSE a managed scope column (annotation only) —
+    only attribute access (filter / set / compare) is policed."""
+
+    title: str
+    deleted_at: datetime.datetime | None
+    tenant_id: str | None

package/corpus/backend/no_manual_scope_filtering/violation-01/modules/notes/service.py

@@ -0,0 +1,2 @@
+def visible_notes(session):
+    return session.exec(select(Note).where(Note.deleted_at == None))  # noqa: E711

package/corpus/backend/no_manual_scope_filtering/violation-02/modules/notes/service.py

@@ -0,0 +1,2 @@
+def move_note(note, target):
+    note.tenant_id = target

package/corpus/backend/no_manual_scope_filtering/violation-03/expected-findings.json

@@ -0,0 +1,7 @@
+[
+  {
+    "rule": "backend/no_manual_scope_filtering",
+    "path": "modules/notes/service.py",
+    "line": 5
+  }
+]

package/corpus/backend/no_manual_scope_filtering/violation-03/modules/notes/service.py

@@ -0,0 +1,7 @@
+def partition(notes, current_tenant):
+    mine = []
+    for note in notes:
+        holder = note
+        if holder.tenant_id == current_tenant:
+            mine.append(note)
+    return mine

package/corpus/backend/no_manual_table_schema/compliant-01/modules/notes/models.py

@@ -0,0 +1,6 @@
+from sqlmodel import Field
+from terp.core import BaseTable
+
+
+class Note(BaseTable, table=True):
+    title: str = Field(max_length=200)

package/corpus/backend/no_manual_table_schema/violation-01/modules/notes/models.py

@@ -0,0 +1,8 @@
+from sqlmodel import Field
+from terp.core import BaseTable
+
+
+class Note(BaseTable, table=True):
+    __table_args__ = {"schema": "notes"}
+
+    title: str = Field(max_length=200)

package/corpus/backend/no_manual_version_assignment/compliant-01/modules/notes/service.py

@@ -0,0 +1,5 @@
+def apply(db_obj, data):
+    # The concurrency token is left untouched; the persistence layer bumps it.
+    db_obj.title = data.title
+    token = db_obj.version
+    return db_obj, token

package/corpus/backend/no_manual_version_assignment/violation-01/modules/notes/service.py

@@ -0,0 +1,3 @@
+def apply(db_obj, data):
+    db_obj.version = data.version
+    return db_obj

package/corpus/backend/no_manual_version_assignment/violation-02/modules/notes/service.py

@@ -0,0 +1,3 @@
+def bump(row):
+    row.version += 1
+    return row

package/corpus/backend/no_manual_version_assignment/violation-03/modules/notes/service.py

@@ -0,0 +1,3 @@
+def apply(db_obj, data):
+    setattr(db_obj, "version", data.version)
+    return db_obj

package/corpus/backend/no_mutable_default_args/compliant-01/modules/notes/service.py

@@ -0,0 +1,3 @@
+def run(items=None):
+    items = items or []
+    return items

package/corpus/backend/no_mutable_default_args/violation-01/modules/notes/service.py

@@ -0,0 +1,2 @@
+def run(items=[]):
+    return items

package/corpus/backend/no_naive_datetime/compliant-01/modules/notes/service.py

@@ -0,0 +1,2 @@
+def run():
+    return datetime.now(UTC)

package/corpus/backend/no_naive_datetime/violation-01/modules/notes/service.py

@@ -0,0 +1,2 @@
+def run():
+    return datetime.utcnow()

package/corpus/backend/no_naive_datetime/violation-02/modules/notes/service.py

@@ -0,0 +1,2 @@
+def run():
+    return datetime.now()

package/corpus/backend/no_oversized_python_files/compliant-01/modules/notes/service.py

@@ -0,0 +1,9 @@
+"""A small, cohesive service — well under the file-size cap."""
+
+from terp.core import BaseService
+
+from .models import Note
+
+
+class NoteService(BaseService[Note]):
+    model = Note