create-astram-app 0.5.0 → 0.7.0

package/template/server/eslint.config.js

@@ -1,95 +0,0 @@
-// ESLint flat config for an Astram consumer app.
-//
-// ─────────────────────────────────────────────────────────────────────────────
-// THE PHYSICAL WALL — backstop (do not remove).
-//
-// The Astram paved road is the ONE way features touch data: inject the framework's
-// RecordEngine (from @astram/engine) and go through the pipe (permission gate +
-// audit are mandatory, cross-tenant isolation is enforced). A feature must NEVER
-// reach the database directly — a raw mariadb/typeorm pool, a DataSource, a
-// QueryRunner, or a repository `.save()`/`.query()` skips the security layer
-// entirely (this is exactly how astram-org's ORS got bypassed 165 times).
-//
-// The PRIMARY wall is structural: the framework never hands feature scope a pool
-// (EngineModule seals it). THIS lint rule is the BACKSTOP: it fails the build if a
-// file under `src/features/**` imports a raw DB symbol or calls a raw DB method, so
-// an off-road attempt is a red build, not a silent success.
-//
-// If you hit this rule because the pipe can't do what you need: STOP. Do NOT work
-// around it. Record the gap in `.astram/guide/gaps.md` and raise it with the
-// framework — the capability must be added to @astram/engine (the gap-flag loop).
-// ─────────────────────────────────────────────────────────────────────────────
-
-import js from '@eslint/js';
-import tseslint from 'typescript-eslint';
-
-/** Raw DB packages a feature must never import directly. */
-const FORBIDDEN_DB_IMPORTS = [
-  { name: 'mariadb', message: 'Wall: features never open a DB pool — use the RecordEngine (@astram/engine).' },
-  { name: 'mysql', message: 'Wall: features never open a DB driver — use the RecordEngine (@astram/engine).' },
-  { name: 'mysql2', message: 'Wall: features never open a DB driver — use the RecordEngine (@astram/engine).' },
-  { name: 'typeorm', message: 'Wall: no ORM in features — use the RecordEngine (@astram/engine).' },
-  { name: '@nestjs/typeorm', message: 'Wall: no ORM in features — use the RecordEngine (@astram/engine).' },
-  { name: 'pg', message: 'Wall: features never open a DB driver — use the RecordEngine (@astram/engine).' },
-  { name: 'knex', message: 'Wall: no query builder in features — use the RecordEngine (@astram/engine).' },
-];
-
-/**
- * Named imports that hand a feature raw DB access even from an ALLOWED package.
- * `SHIELD_DB_POOL` is exported from `@astram/guard` (a package a feature legitimately
- * imports for other reasons), so it must be blocked by NAME on that path — the engine
- * owns the pool; feature scope must never import the pool token.
- */
-const FORBIDDEN_DB_NAMED_FROM = [
-  {
-    name: '@astram/guard',
-    importNames: ['SHIELD_DB_POOL'],
-    message: 'Wall: the DB pool is sealed inside the engine — features use the RecordEngine (@astram/engine).',
-  },
-];
-
-export default tseslint.config(
-  js.configs.recommended,
-  ...tseslint.configs.recommended,
-  {
-    ignores: ['dist/**', 'node_modules/**'],
-  },
-  // ── The wall: scoped to feature code ──────────────────────────────────────
-  {
-    files: ['src/features/**/*.ts'],
-    rules: {
-      'no-restricted-imports': [
-        'error',
-        {
-          paths: [...FORBIDDEN_DB_IMPORTS, ...FORBIDDEN_DB_NAMED_FROM],
-          patterns: [
-            {
-              group: ['**/adapters/mariadb-*', '@astram/engine/dist/adapters/*'],
-              message:
-                'Wall: the engine adapters (pool/uow/audit) are framework-internal — features use the RecordEngine facade only.',
-            },
-          ],
-        },
-      ],
-      // Block raw query-runner / repository calls even if a pool were obtained.
-      'no-restricted-syntax': [
-        'error',
-        {
-          selector:
-            "CallExpression[callee.property.name='createQueryRunner']",
-          message: 'Wall: no QueryRunner in features — use the RecordEngine (@astram/engine).',
-        },
-        {
-          selector:
-            "CallExpression[callee.property.name='getRepository']",
-          message: 'Wall: no repository access in features — use the RecordEngine (@astram/engine).',
-        },
-        {
-          selector:
-            "CallExpression[callee.property.name='createPool']",
-          message: 'Wall: features never create a DB pool — use the RecordEngine (@astram/engine).',
-        },
-      ],
-    },
-  },
-);