eslint-plugin-ai-guard 1.1.7 → 1.1.9

package/dist/index.js

@@ -265,13 +265,43 @@ var createRule5 = import_utils5.ESLintUtils.RuleCreator(
 );
 var ARRAY_CALLBACK_METHODS = ["map", "filter", "forEach", "reduce", "flatMap", "find", "findIndex", "some", "every"];
 var PROMISE_COMBINATORS = ["all", "allSettled", "race", "any"];
+var METHODS_ALLOWING_PROMISE_COLLECTION = /* @__PURE__ */ new Set(["map", "flatMap"]);
+function isNode(value) {
+  return typeof value === "object" && value !== null && "type" in value;
+}
+function getChildNodes(node) {
+  const children = [];
+  for (const [key, value] of Object.entries(node)) {
+    if (key === "parent") continue;
+    if (!value) continue;
+    if (Array.isArray(value)) {
+      for (const item of value) {
+        if (isNode(item)) {
+          children.push(item);
+        }
+      }
+      continue;
+    }
+    if (isNode(value)) {
+      children.push(value);
+    }
+  }
+  return children;
+}
+function isPromiseCombinatorCall(node) {
+  return node.callee.type === import_utils5.AST_NODE_TYPES.MemberExpression && node.callee.object.type === import_utils5.AST_NODE_TYPES.Identifier && node.callee.object.name === "Promise" && node.callee.property.type === import_utils5.AST_NODE_TYPES.Identifier && PROMISE_COMBINATORS.includes(
+    node.callee.property.name
+  );
+}
 function isWrappedInPromiseCombinator(node, context) {
   const ancestors = context.sourceCode.getAncestors(node);
+  const directParent = node.parent;
+  if (directParent && directParent.type === import_utils5.AST_NODE_TYPES.CallExpression && isPromiseCombinatorCall(directParent)) {
+    return true;
+  }
   for (let i = ancestors.length - 1; i >= 0; i--) {
     const ancestor = ancestors[i];
-    if (ancestor.type === import_utils5.AST_NODE_TYPES.CallExpression && ancestor.callee.type === import_utils5.AST_NODE_TYPES.MemberExpression && ancestor.callee.object.type === import_utils5.AST_NODE_TYPES.Identifier && ancestor.callee.object.name === "Promise" && ancestor.callee.property.type === import_utils5.AST_NODE_TYPES.Identifier && PROMISE_COMBINATORS.includes(
-      ancestor.callee.property.name
-    )) {
+    if (ancestor.type === import_utils5.AST_NODE_TYPES.CallExpression && isPromiseCombinatorCall(ancestor)) {
       return true;
     }
     if (ancestor.type === import_utils5.AST_NODE_TYPES.CallExpression) {
@@ -280,6 +310,52 @@ function isWrappedInPromiseCombinator(node, context) {
   }
   return false;
 }
+function isIdentifierConsumedByPromiseCombinator(node, identifierName) {
+  let found = false;
+  const visit = (current) => {
+    if (found) return;
+    if (current.type === import_utils5.AST_NODE_TYPES.CallExpression && isPromiseCombinatorCall(current)) {
+      for (const arg of current.arguments) {
+        if (arg.type === import_utils5.AST_NODE_TYPES.Identifier && arg.name === identifierName) {
+          found = true;
+          return;
+        }
+      }
+    }
+    for (const child of getChildNodes(current)) {
+      visit(child);
+      if (found) return;
+    }
+  };
+  visit(node);
+  return found;
+}
+function isAssignedAndConsumedByPromiseCombinator(node) {
+  if (!node.parent || node.parent.type !== import_utils5.AST_NODE_TYPES.VariableDeclarator || node.parent.id.type !== import_utils5.AST_NODE_TYPES.Identifier) {
+    return false;
+  }
+  const variableName = node.parent.id.name;
+  const declaration = node.parent.parent;
+  if (!declaration || declaration.type !== import_utils5.AST_NODE_TYPES.VariableDeclaration) {
+    return false;
+  }
+  const container = declaration.parent;
+  if (!container || container.type !== import_utils5.AST_NODE_TYPES.Program && container.type !== import_utils5.AST_NODE_TYPES.BlockStatement) {
+    return false;
+  }
+  const body = container.body;
+  const declarationIndex = body.findIndex((statement) => statement === declaration);
+  if (declarationIndex === -1) {
+    return false;
+  }
+  for (let i = declarationIndex + 1; i < body.length; i++) {
+    const statement = body[i];
+    if (isIdentifierConsumedByPromiseCombinator(statement, variableName)) {
+      return true;
+    }
+  }
+  return false;
+}
 function isAsyncCallback(node) {
   return (node.type === import_utils5.AST_NODE_TYPES.FunctionExpression || node.type === import_utils5.AST_NODE_TYPES.ArrowFunctionExpression) && node.async;
 }
@@ -317,6 +393,9 @@ var noAsyncArrayCallback = createRule5({
           if (isWrappedInPromiseCombinator(node, context)) {
             return;
           }
+          if (METHODS_ALLOWING_PROMISE_COLLECTION.has(methodName) && isAssignedAndConsumedByPromiseCombinator(node)) {
+            return;
+          }
           context.report({
             node: callback,
             messageId: "asyncArrayCallback",
@@ -335,26 +414,66 @@ var import_utils6 = require("@typescript-eslint/utils");
 var createRule6 = import_utils6.ESLintUtils.RuleCreator(
   (name) => `https://github.com/YashJadhav21/eslint-plugin-ai-guard/blob/main/docs/rules/${name}.md`
 );
-function looksLikeAsyncCall(node) {
+var KNOWN_PROMISE_FACTORIES = /* @__PURE__ */ new Set([
+  "fetch"
+]);
+var PROMISE_STATIC_METHODS = /* @__PURE__ */ new Set([
+  "resolve",
+  "reject",
+  "all",
+  "allSettled",
+  "race",
+  "any"
+]);
+function isLocallyAsyncCallee(node, asyncFunctionNames) {
   if (node.callee.type === import_utils6.AST_NODE_TYPES.Identifier) {
-    return hasAsyncishName(node.callee.name);
+    if (asyncFunctionNames.has(node.callee.name)) {
+      return true;
+    }
   }
-  if (node.callee.type === import_utils6.AST_NODE_TYPES.MemberExpression && node.callee.property.type === import_utils6.AST_NODE_TYPES.Identifier) {
-    return hasAsyncishName(node.callee.property.name);
+  if ((node.callee.type === import_utils6.AST_NODE_TYPES.FunctionExpression || node.callee.type === import_utils6.AST_NODE_TYPES.ArrowFunctionExpression) && node.callee.async) {
+    return true;
   }
   return false;
 }
-function hasAsyncishName(name) {
-  const lower = name.toLowerCase();
-  return lower.startsWith("fetch") || lower.startsWith("load") || lower.startsWith("save") || lower.startsWith("delete") || lower.startsWith("create") || lower.startsWith("update") || lower.startsWith("get") || lower.startsWith("post") || lower.startsWith("put") || lower.startsWith("patch") || lower.startsWith("send") || lower.startsWith("upload") || lower.startsWith("download") || lower.startsWith("connect") || lower.startsWith("disconnect") || lower.startsWith("subscribe") || lower.startsWith("publish") || lower.startsWith("request") || lower.startsWith("query") || lower === "axios" || lower === "fetch";
-}
-function isCalleeAsync(node, asyncFunctionNames) {
+function isKnownPromiseFactoryCall(node) {
   if (node.callee.type === import_utils6.AST_NODE_TYPES.Identifier) {
-    if (asyncFunctionNames.has(node.callee.name)) {
-      return true;
+    return KNOWN_PROMISE_FACTORIES.has(node.callee.name);
+  }
+  if (node.callee.type === import_utils6.AST_NODE_TYPES.MemberExpression && node.callee.object.type === import_utils6.AST_NODE_TYPES.Identifier && node.callee.object.name === "Promise" && node.callee.property.type === import_utils6.AST_NODE_TYPES.Identifier) {
+    return PROMISE_STATIC_METHODS.has(node.callee.property.name);
+  }
+  return false;
+}
+function getParserServices(context) {
+  const services = context.sourceCode.parserServices;
+  if (!services || typeof services !== "object") {
+    return null;
+  }
+  return services;
+}
+function isPromiseLikeByTypeInfo(node, context) {
+  const services = getParserServices(context);
+  if (!services?.program || !services.esTreeNodeToTSNodeMap) {
+    return false;
+  }
+  try {
+    const tsNode = services.esTreeNodeToTSNodeMap.get(node);
+    if (!tsNode) {
+      return false;
     }
+    const checker = services.program.getTypeChecker();
+    const type = checker.getTypeAtLocation(tsNode);
+    if (typeof checker.getPromisedTypeOfPromise === "function") {
+      if (checker.getPromisedTypeOfPromise(type)) {
+        return true;
+      }
+    }
+    const text = checker.typeToString(type).toLowerCase();
+    return text === "promise" || text.includes("promise<") || text.includes("promiselike<") || text.includes("thenable");
+  } catch {
+    return false;
   }
-  return looksLikeAsyncCall(node);
 }
 function isExpressionHandled(node) {
   const expr = node.expression;
@@ -404,6 +523,13 @@ var noFloatingPromise = createRule6({
       },
       // Check ExpressionStatements — standalone call expressions
       ExpressionStatement(node) {
+        if (node.expression.type === import_utils6.AST_NODE_TYPES.NewExpression && node.expression.callee.type === import_utils6.AST_NODE_TYPES.Identifier && node.expression.callee.name === "Promise") {
+          context.report({
+            node,
+            messageId: "floatingPromise"
+          });
+          return;
+        }
         if (node.expression.type !== import_utils6.AST_NODE_TYPES.CallExpression) {
           return;
         }
@@ -411,7 +537,7 @@ var noFloatingPromise = createRule6({
           return;
         }
         const callExpr = node.expression;
-        if (isCalleeAsync(callExpr, asyncFunctionNames)) {
+        if (isLocallyAsyncCallee(callExpr, asyncFunctionNames) || isKnownPromiseFactoryCall(callExpr) || isPromiseLikeByTypeInfo(callExpr, context)) {
           context.report({
             node,
             messageId: "floatingPromise"
@@ -434,6 +560,80 @@ var LOOP_TYPES = /* @__PURE__ */ new Set([
   import_utils7.AST_NODE_TYPES.WhileStatement,
   import_utils7.AST_NODE_TYPES.DoWhileStatement
 ]);
+var SEQUENTIAL_CALL_HINTS = [
+  "read",
+  "next",
+  "retry",
+  "sleep",
+  "delay",
+  "wait",
+  "throttle",
+  "ratelimit",
+  "acquire",
+  "release",
+  "drain",
+  "flush",
+  "consume"
+];
+var INTENT_COMMENT_HINTS = [
+  "sequential",
+  "ordered",
+  "order matters",
+  "intentional",
+  "rate limit",
+  "rate-limit",
+  "retry",
+  "stream",
+  "backpressure"
+];
+function getCalleeName(callee) {
+  if (callee.type === import_utils7.AST_NODE_TYPES.Identifier) {
+    return callee.name;
+  }
+  if (callee.type === import_utils7.AST_NODE_TYPES.MemberExpression && callee.property.type === import_utils7.AST_NODE_TYPES.Identifier) {
+    return callee.property.name;
+  }
+  return null;
+}
+function isLikelySequentialAwaitCall(node) {
+  if (node.argument.type !== import_utils7.AST_NODE_TYPES.CallExpression) {
+    return false;
+  }
+  const calleeName = getCalleeName(node.argument.callee);
+  if (!calleeName) {
+    return false;
+  }
+  const lower = calleeName.toLowerCase();
+  return SEQUENTIAL_CALL_HINTS.some((hint) => lower.includes(hint));
+}
+function hasIntentionalSequentialComment(loopNode, sourceCode) {
+  const directComments = sourceCode.getCommentsBefore(loopNode);
+  const allComments = sourceCode.getAllComments();
+  const nearComments = allComments.filter((comment) => {
+    if (!comment.range || !loopNode.range) {
+      return false;
+    }
+    const [commentStart, commentEnd] = comment.range;
+    const [loopStart, loopEnd] = loopNode.range;
+    const insideLoop = commentStart >= loopStart && commentEnd <= loopEnd;
+    const immediatelyBeforeLoop = commentEnd <= loopStart && loopStart - commentEnd < 120;
+    return insideLoop || immediatelyBeforeLoop;
+  });
+  const combined = [...directComments, ...nearComments];
+  return combined.some((comment) => {
+    const lower = comment.value.toLowerCase();
+    return INTENT_COMMENT_HINTS.some((hint) => lower.includes(hint));
+  });
+}
+function shouldAllowIntentionalSequentialAwait(loopNode, awaitNode, context) {
+  if (loopNode.type === import_utils7.AST_NODE_TYPES.ForOfStatement && loopNode.await) {
+    return true;
+  }
+  if (hasIntentionalSequentialComment(loopNode, context.sourceCode)) {
+    return true;
+  }
+  return isLikelySequentialAwaitCall(awaitNode);
+}
 var noAwaitInLoop = createRule7({
   name: "no-await-in-loop",
   meta: {
@@ -472,6 +672,10 @@ var noAwaitInLoop = createRule7({
             break;
           }
           if (LOOP_TYPES.has(ancestor.type)) {
+            const loopNode = ancestor;
+            if (shouldAllowIntentionalSequentialAwait(loopNode, node, context)) {
+              return;
+            }
             const loopName = getLoopName(ancestor.type);
             context.report({
               node,
@@ -859,6 +1063,60 @@ var createRule12 = import_utils12.ESLintUtils.RuleCreator(
   (name) => `https://github.com/YashJadhav21/eslint-plugin-ai-guard/blob/main/docs/rules/${name}.md`
 );
 var SQL_STATEMENT_PATTERN = /\b(select\s+[\s\S]*\s+from|insert\s+into|update\s+\S+\s+set|delete\s+from|drop\s+table|create\s+(table|database)|alter\s+table|truncate\s+table|exec(?:ute)?\s+\S+|union\s+select)\b/i;
+var SQL_SINK_METHODS = /* @__PURE__ */ new Set([
+  "query",
+  "execute",
+  "queryraw",
+  "queryrawunsafe",
+  "executeraw",
+  "executerawunsafe",
+  "raw",
+  "run",
+  "all",
+  "get",
+  "prepare"
+]);
+var SQL_SINK_FUNCTIONS = /* @__PURE__ */ new Set(["query", "execute"]);
+function getIdentifierName(node) {
+  if (node.type === import_utils12.AST_NODE_TYPES.Identifier) {
+    return node.name;
+  }
+  return null;
+}
+function isSqlSinkCall(node) {
+  if (node.callee.type === import_utils12.AST_NODE_TYPES.Identifier) {
+    return SQL_SINK_FUNCTIONS.has(node.callee.name.toLowerCase());
+  }
+  if (node.callee.type === import_utils12.AST_NODE_TYPES.MemberExpression && node.callee.property.type === import_utils12.AST_NODE_TYPES.Identifier) {
+    const methodName = node.callee.property.name.toLowerCase().replace(/^\$/, "");
+    return SQL_SINK_METHODS.has(methodName);
+  }
+  return false;
+}
+function resolveExpression(node, variableMap) {
+  const identifier = getIdentifierName(node);
+  if (identifier && variableMap.has(identifier)) {
+    return variableMap.get(identifier);
+  }
+  return node;
+}
+function isDynamicSqlExpression(node) {
+  if (node.type === import_utils12.AST_NODE_TYPES.TemplateLiteral) {
+    if (node.expressions.length === 0) {
+      return false;
+    }
+    const staticText = node.quasis.map((q) => q.value.raw).join(" ");
+    return SQL_STATEMENT_PATTERN.test(staticText);
+  }
+  if (node.type === import_utils12.AST_NODE_TYPES.BinaryExpression && node.operator === "+") {
+    const staticText = collectStaticText(node);
+    if (!SQL_STATEMENT_PATTERN.test(staticText)) {
+      return false;
+    }
+    return hasDynamicParts(node);
+  }
+  return false;
+}
 var noSqlStringConcat = createRule12({
   name: "no-sql-string-concat",
   meta: {
@@ -874,32 +1132,34 @@ var noSqlStringConcat = createRule12({
   },
   defaultOptions: [],
   create(context) {
+    const variableMap = /* @__PURE__ */ new Map();
     return {
-      // Template literals: `SELECT * FROM users WHERE id = ${userId}`
-      TemplateLiteral(node) {
-        if (node.expressions.length === 0) return;
-        const staticText = node.quasis.map((q) => q.value.raw).join("");
-        if (SQL_STATEMENT_PATTERN.test(staticText)) {
-          context.report({
-            node,
-            messageId: "sqlStringConcat"
-          });
+      VariableDeclarator(node) {
+        if (node.id.type === import_utils12.AST_NODE_TYPES.Identifier && node.init && node.init.type !== import_utils12.AST_NODE_TYPES.AwaitExpression) {
+          variableMap.set(node.id.name, node.init);
+        }
+      },
+      AssignmentExpression(node) {
+        if (node.left.type === import_utils12.AST_NODE_TYPES.Identifier && node.right.type !== import_utils12.AST_NODE_TYPES.AwaitExpression) {
+          variableMap.set(node.left.name, node.right);
         }
       },
-      // Binary expressions: "SELECT * FROM users WHERE id = " + userId
-      BinaryExpression(node) {
-        if (node.operator !== "+") return;
-        if (node.parent?.type === import_utils12.AST_NODE_TYPES.BinaryExpression && node.parent.operator === "+") {
+      CallExpression(node) {
+        if (!isSqlSinkCall(node)) {
           return;
         }
-        const staticText = collectStaticText(node);
-        if (!SQL_STATEMENT_PATTERN.test(staticText)) return;
-        if (hasDynamicParts(node)) {
-          context.report({
-            node,
-            messageId: "sqlStringConcat"
-          });
+        const firstArg = node.arguments[0];
+        if (!firstArg || firstArg.type === import_utils12.AST_NODE_TYPES.SpreadElement) {
+          return;
         }
+        const resolved = resolveExpression(firstArg, variableMap);
+        if (!isDynamicSqlExpression(resolved)) {
+          return;
+        }
+        context.report({
+          node: firstArg,
+          messageId: "sqlStringConcat"
+        });
       }
     };
   }