eslint-plugin-no-mistakes 0.44.0 → 0.45.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-no-mistakes",
-  "version": "0.44.0",
+  "version": "0.45.0",
   "description": "ESLint and Oxlint rules for deterministic no-mistakes code analysis",
   "license": "MIT",
   "repository": {

package/src/index.js

@@ -29,6 +29,8 @@ const rules = {
   "playwright-selector-priority": require("./rules/playwright-selector-priority"),
   "react-no-iife-in-jsx": require("./rules/react-no-iife-in-jsx"),
   "playwright-unique": require("./rules/playwright-unique"),
+  "postgres-no-manual-transaction": require("./rules/postgres-no-manual-transaction"),
+  "postgres-no-unbounded-query-fanout": require("./rules/postgres-no-unbounded-query-fanout"),
   "react-no-nullish-react-node": require("./rules/react-no-nullish-react-node"),
   "react-no-use-promise-resolve": require("./rules/react-no-use-promise-resolve"),
   "server-require-nullable-fetch-wrapper": require("./rules/server-require-nullable-fetch-wrapper"),

package/src/rules/postgres-executor.js

@@ -0,0 +1,117 @@
+"use strict";
+
+const { quasiText, sqlText, unwrapTs } = require("./postgres-query-text");
+
+const DEFAULT_IMPORT_SPECIFIER = "@data-stores/psql";
+const DEFAULT_EXECUTOR_NAMES = ["query", "read", "write"];
+const DEFAULT_CHUNK_FUNCTION_NAMES = ["chunkArray"];
+const TRANSACTION_IMPORTS = new Set(["withTransaction", "withTransactionOptions"]);
+const QUERY_PROPERTY = "query";
+const TRANSACTION_COMMAND = /^\s*(?:BEGIN|COMMIT|ROLLBACK)\b/i;
+
+function executorOptionDefaults(options = {}) {
+  return {
+    importSpecifier: options.importSpecifier ?? DEFAULT_IMPORT_SPECIFIER,
+    executorNames: options.executorNames ?? DEFAULT_EXECUTOR_NAMES,
+    owners: options.owners ?? [],
+    chunkFunctionNames: options.chunkFunctionNames ?? DEFAULT_CHUNK_FUNCTION_NAMES,
+  };
+}
+
+function executorOptionSchema(extraProperties = {}) {
+  return {
+    type: "object",
+    properties: {
+      importSpecifier: { type: "string" },
+      executorNames: { type: "array", items: { type: "string" } },
+      ...extraProperties,
+    },
+    additionalProperties: false,
+  };
+}
+
+function importedName(specifier) {
+  const imported = specifier?.imported;
+  if (!imported) return null;
+  return imported.type === "Literal" ? String(imported.value) : imported.name;
+}
+
+function executorBindings(program, options = {}) {
+  const bindings = new Set();
+  const { importSpecifier, executorNames } = executorOptionDefaults(options);
+  for (const statement of program?.body ?? []) {
+    if (statement.type !== "ImportDeclaration") continue;
+    if (statement.importKind === "type") continue;
+    if (statement.source?.value !== importSpecifier) continue;
+    for (const specifier of statement.specifiers ?? []) {
+      if (specifier.type !== "ImportSpecifier") continue;
+      if (specifier.importKind === "type") continue;
+      const imported = importedName(specifier);
+      if (TRANSACTION_IMPORTS.has(imported)) bindings.add(QUERY_PROPERTY);
+      if (imported && executorNames.includes(imported)) bindings.add(specifier.local.name);
+    }
+  }
+  return bindings;
+}
+
+function staticQueryKey(node) {
+  node = unwrapTs(node);
+  if (!node) return false;
+  if (node.type === "Literal") return node.value === QUERY_PROPERTY;
+  if (node.type === "TemplateLiteral" && node.expressions.length === 0) {
+    return quasiText(node.quasis[0]) === QUERY_PROPERTY;
+  }
+  return false;
+}
+
+function memberPropertyName(node) {
+  if (!node || node.type !== "MemberExpression") return null;
+  if (!node.computed) return node.property?.name ?? null;
+  if (staticQueryKey(node.property)) return QUERY_PROPERTY;
+  return sqlText(node.property);
+}
+
+function calleeName(call, bindings) {
+  const callee = unwrapTs(call?.callee);
+  if (!callee) return null;
+  if (callee.type === "Identifier" && bindings?.has(callee.name)) return callee.name;
+  if (callee.type === "MemberExpression" && memberPropertyName(callee) === QUERY_PROPERTY) {
+    return QUERY_PROPERTY;
+  }
+  return null;
+}
+
+function isDatabaseCall(call, bindings) {
+  return call?.type === "CallExpression" && calleeName(call, bindings) != null;
+}
+
+function firstCallArgument(call) {
+  const argument = call?.arguments?.[0];
+  if (!argument || argument.type === "SpreadElement") return null;
+  return argument;
+}
+
+function stripSqlComments(text) {
+  return text.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/--[^\n]*/g, " ");
+}
+
+function isManualTransactionText(text) {
+  return typeof text === "string" && TRANSACTION_COMMAND.test(stripSqlComments(text));
+}
+
+module.exports = {
+  DEFAULT_CHUNK_FUNCTION_NAMES,
+  DEFAULT_EXECUTOR_NAMES,
+  DEFAULT_IMPORT_SPECIFIER,
+  QUERY_PROPERTY,
+  TRANSACTION_COMMAND,
+  TRANSACTION_IMPORTS,
+  calleeName,
+  executorBindings,
+  executorOptionDefaults,
+  executorOptionSchema,
+  firstCallArgument,
+  isDatabaseCall,
+  isManualTransactionText,
+  memberPropertyName,
+};

package/src/rules/postgres-no-manual-transaction.js

@@ -0,0 +1,58 @@
+"use strict";
+
+const { rule } = require("../helpers");
+const helpers = require("./postgres-runtime-helpers");
+
+const {
+  executedQueryText,
+  executorBindings,
+  executorOptionDefaults,
+  executorOptionSchema,
+  firstCallArgument,
+  isDatabaseCall,
+  isManualTransactionText,
+  isOwnerFile,
+  sqlStatementBindings,
+} = helpers;
+
+module.exports = Object.assign(
+  rule(
+    {
+      type: "problem",
+      docs: {
+        description: "disallow manual BEGIN, COMMIT, and ROLLBACK executor calls",
+        recommended: false,
+      },
+      schema: [
+        executorOptionSchema({
+          owners: { type: "array", items: { type: "string" } },
+        }),
+      ],
+      messages: {
+        manualTransaction:
+          "Do not execute BEGIN, COMMIT, or ROLLBACK through a query executor. Use withTransaction / withTransactionOptions so the owner helper owns transaction lifecycle.",
+      },
+    },
+    (context) => {
+      const options = executorOptionDefaults(context.options?.[0] ?? {});
+      if (isOwnerFile(context.filename, options.owners)) return {};
+      let bindings = new Set();
+      let statements = new Map();
+
+      return {
+        Program(node) {
+          bindings = executorBindings(node, options);
+          statements = sqlStatementBindings(node);
+        },
+        CallExpression(node) {
+          if (!isDatabaseCall(node, bindings)) return;
+          const argument = firstCallArgument(node);
+          const text = executedQueryText(argument, statements, context);
+          if (!isManualTransactionText(text)) return;
+          context.report({ node, messageId: "manualTransaction" });
+        },
+      };
+    },
+  ),
+  { __test: helpers },
+);

package/src/rules/postgres-no-unbounded-query-fanout.js

@@ -0,0 +1,54 @@
+"use strict";
+
+const { rule } = require("../helpers");
+const helpers = require("./postgres-runtime-helpers");
+
+const {
+  callbackContainsExecutor,
+  executorBindings,
+  executorOptionDefaults,
+  executorOptionSchema,
+  isPromiseAllCallee,
+  isStaticallyBounded,
+  mapCallArgument,
+} = helpers;
+
+module.exports = Object.assign(
+  rule(
+    {
+      type: "problem",
+      docs: {
+        description: "disallow unbounded Promise.all map fan-out of query executors",
+        recommended: false,
+      },
+      schema: [
+        executorOptionSchema({
+          chunkFunctionNames: { type: "array", items: { type: "string" } },
+        }),
+      ],
+      messages: {
+        unboundedFanout:
+          "Do not fan out unbounded mapped executor calls through Promise.all(). Use a static array, a SCREAMING_CASE constant, or a configured chunk helper first.",
+      },
+    },
+    (context) => {
+      const options = executorOptionDefaults(context.options?.[0] ?? {});
+      let bindings = new Set();
+
+      return {
+        Program(node) {
+          bindings = executorBindings(node, options);
+        },
+        CallExpression(node) {
+          if (!isPromiseAllCallee(node.callee)) return;
+          const mapped = mapCallArgument(node);
+          if (!mapped) return;
+          if (isStaticallyBounded(mapped.source, options.chunkFunctionNames, context)) return;
+          if (!callbackContainsExecutor(mapped.callback, bindings, context)) return;
+          context.report({ node, messageId: "unboundedFanout" });
+        },
+      };
+    },
+  ),
+  { __test: helpers },
+);

package/src/rules/postgres-query-text.js

@@ -0,0 +1,125 @@
+"use strict";
+
+const TS_WRAPPERS = new Set([
+  "ChainExpression",
+  "TSAsExpression",
+  "TSInstantiationExpression",
+  "TSNonNullExpression",
+  "TSSatisfiesExpression",
+  "TSTypeAssertion",
+]);
+
+function unwrapTs(node) {
+  while (node && TS_WRAPPERS.has(node.type)) {
+    node = node.expression;
+  }
+  return node;
+}
+
+function childNodes(node) {
+  const children = [];
+  if (!node || typeof node !== "object") return children;
+  for (const [key, value] of Object.entries(node)) {
+    if (key === "parent") continue;
+    if (Array.isArray(value)) {
+      for (const item of value) {
+        if (item?.type) children.push(item);
+      }
+    } else if (value?.type) {
+      children.push(value);
+    }
+  }
+  return children;
+}
+
+function quasiText(quasi) {
+  return quasi?.value?.cooked ?? quasi?.value?.raw ?? "";
+}
+
+function templateSqlText(template) {
+  let out = "";
+  const quasis = template?.quasis ?? [];
+  for (let index = 0; index < quasis.length; index += 1) {
+    if (index > 0) out += `sql_placeholder_${index}`;
+    out += quasiText(quasis[index]);
+  }
+  return out;
+}
+
+function sqlText(node) {
+  node = unwrapTs(node);
+  if (!node) return null;
+  if (node.type === "Literal" && typeof node.value === "string") return node.value;
+  if (node.type === "TemplateLiteral") return templateSqlText(node);
+  if (node.type === "TaggedTemplateExpression") return templateSqlText(node.quasi);
+  return null;
+}
+
+function variableFromScope(scope, name) {
+  const get = scope?.set?.get;
+  if (typeof get === "function") return get.call(scope.set, name) ?? null;
+  return scope?.variables?.find((item) => item.name === name) ?? null;
+}
+
+function resolveVariable(node, context) {
+  if (node?.type !== "Identifier" || !context?.sourceCode?.getScope) return null;
+  let scope = context.sourceCode.getScope(node);
+  while (scope) {
+    const variable = variableFromScope(scope, node.name);
+    if (variable) return variable;
+    scope = scope.upper;
+  }
+  return null;
+}
+
+function queryTextFromScope(ident, context) {
+  const variable = resolveVariable(ident, context);
+  if (!variable) return null;
+  if (variable.defs.some((def) => def.type === "Parameter" || def.type === "CatchClause")) {
+    return null;
+  }
+  for (const def of variable.defs) {
+    if (def.type !== "Variable" || def.node?.id?.type !== "Identifier") continue;
+    const text = sqlText(def.node.init);
+    if (text != null) return text;
+  }
+  return null;
+}
+
+function executedQueryText(node, bindings, context) {
+  const text = sqlText(node);
+  if (text != null) return text;
+  node = unwrapTs(node);
+  if (node?.type !== "Identifier") return null;
+  if (context) {
+    const scoped = queryTextFromScope(node, context);
+    if (scoped != null) return scoped;
+    const variable = resolveVariable(node, context);
+    if (variable) return null;
+  }
+  return bindings instanceof Map ? (bindings.get(node.name) ?? null) : null;
+}
+
+function sqlStatementBindings(root) {
+  const bindings = new Map();
+  function visit(node) {
+    if (node.type === "VariableDeclarator" && node.id?.type === "Identifier") {
+      const text = sqlText(node.init);
+      if (text != null) bindings.set(node.id.name, text);
+    }
+    for (const child of childNodes(node)) visit(child);
+  }
+  if (root?.type) visit(root);
+  return bindings;
+}
+
+module.exports = {
+  childNodes,
+  executedQueryText,
+  quasiText,
+  resolveVariable,
+  sqlStatementBindings,
+  sqlText,
+  templateSqlText,
+  unwrapTs,
+};

package/src/rules/postgres-runtime-helpers.js

@@ -0,0 +1,178 @@
+"use strict";
+
+const { repoRelativeFilename } = require("./module-mock-helpers");
+const {
+  DEFAULT_CHUNK_FUNCTION_NAMES,
+  DEFAULT_EXECUTOR_NAMES,
+  DEFAULT_IMPORT_SPECIFIER,
+  QUERY_PROPERTY,
+  TRANSACTION_COMMAND,
+  TRANSACTION_IMPORTS,
+  calleeName,
+  executorBindings,
+  executorOptionDefaults,
+  executorOptionSchema,
+  firstCallArgument,
+  isDatabaseCall,
+  isManualTransactionText,
+  memberPropertyName,
+} = require("./postgres-executor");
+const {
+  childNodes,
+  executedQueryText,
+  resolveVariable,
+  sqlStatementBindings,
+  sqlText,
+  templateSqlText,
+  unwrapTs,
+} = require("./postgres-query-text");
+
+const SCREAMING_CASE = /^[A-Z][A-Z0-9_]*$/;
+
+function isOwnerFile(filename, owners) {
+  if (!filename || !owners?.length) return false;
+  const normalized = String(filename).replace(/\\/g, "/");
+  const relative = repoRelativeFilename(filename);
+  return owners.some(
+    (owner) => pathMatchesOwner(normalized, owner) || pathMatchesOwner(relative, owner),
+  );
+}
+
+function pathMatchesOwner(path, owner) {
+  const needle = String(owner ?? "").replace(/\\/g, "/");
+  if (!needle) return false;
+  if (path === needle) return true;
+  const suffix = needle.replace(/^\/+/, "");
+  return Boolean(suffix) && path.endsWith(`/${suffix}`);
+}
+
+function callName(node) {
+  const callee = unwrapTs(node?.callee);
+  if (!callee) return null;
+  if (callee.type === "Identifier") return callee.name;
+  if (callee.type === "MemberExpression") return memberPropertyName(callee);
+  return null;
+}
+
+function isChunkCall(node, chunkFunctionNames) {
+  const name = callName(node);
+  return Boolean(name && chunkFunctionNames.includes(name));
+}
+
+function isStaticallyBounded(source, chunkFunctionNames, context) {
+  source = unwrapTs(source);
+  if (!source) return false;
+  if (source.type === "ArrayExpression") return true;
+  if (source.type === "Identifier" && SCREAMING_CASE.test(source.name)) return true;
+  if (source.type === "CallExpression" && isChunkCall(source, chunkFunctionNames)) return true;
+  if (source.type === "Identifier" && context) {
+    const variable = resolveVariable(source, context);
+    const init = variable?.defs?.find(
+      (def) => def.type === "Variable" && def.node?.id?.type === "Identifier",
+    )?.node?.init;
+    if (init && init !== source) return isStaticallyBounded(init, chunkFunctionNames, null);
+  }
+  return false;
+}
+
+function isPromiseAllCallee(node) {
+  const callee = unwrapTs(node);
+  if (callee?.type !== "MemberExpression" || callee.computed) return false;
+  if (callee.property?.name !== "all") return false;
+  const object = unwrapTs(callee.object);
+  return object?.type === "Identifier" && object.name === "Promise";
+}
+
+function mapCallArgument(node) {
+  const argument = unwrapTs(firstCallArgument(node));
+  if (argument?.type !== "CallExpression") return null;
+  const callee = unwrapTs(argument.callee);
+  if (callee?.type !== "MemberExpression") return null;
+  if (memberPropertyName(callee) !== "map") return null;
+  return {
+    source: unwrapTs(callee.object),
+    callback: argument.arguments[0],
+    mapCall: argument,
+  };
+}
+
+function containsDatabaseCall(node, bindings) {
+  if (!node || typeof node !== "object") return false;
+  if (isDatabaseCall(node, bindings)) return true;
+  for (const child of childNodes(node)) {
+    if (containsDatabaseCall(child, bindings)) return true;
+  }
+  return false;
+}
+
+function functionFromDefinition(def) {
+  const node = def?.node;
+  if (!node) return null;
+  if (
+    node.type === "FunctionDeclaration" ||
+    node.type === "FunctionExpression" ||
+    node.type === "ArrowFunctionExpression"
+  ) {
+    return node;
+  }
+  const init = node.init;
+  if (
+    init &&
+    (init.type === "FunctionExpression" ||
+      init.type === "ArrowFunctionExpression" ||
+      init.type === "FunctionDeclaration")
+  ) {
+    return init;
+  }
+  return null;
+}
+
+function callbackContainsExecutor(callback, bindings, context) {
+  callback = unwrapTs(callback);
+  if (!callback) return false;
+  if (
+    callback.type === "ArrowFunctionExpression" ||
+    callback.type === "FunctionExpression" ||
+    callback.type === "FunctionDeclaration"
+  ) {
+    return containsDatabaseCall(callback, bindings);
+  }
+  if (callback.type !== "Identifier") return false;
+  if (bindings?.has(callback.name)) return true;
+  if (!context) return false;
+  const variable = resolveVariable(callback, context);
+  for (const def of variable?.defs ?? []) {
+    const fn = functionFromDefinition(def);
+    if (fn && containsDatabaseCall(fn, bindings)) return true;
+  }
+  return false;
+}
+
+module.exports = {
+  DEFAULT_CHUNK_FUNCTION_NAMES,
+  DEFAULT_EXECUTOR_NAMES,
+  DEFAULT_IMPORT_SPECIFIER,
+  QUERY_PROPERTY,
+  TRANSACTION_COMMAND,
+  TRANSACTION_IMPORTS,
+  callbackContainsExecutor,
+  calleeName,
+  childNodes,
+  containsDatabaseCall,
+  executedQueryText,
+  executorBindings,
+  executorOptionDefaults,
+  executorOptionSchema,
+  firstCallArgument,
+  isDatabaseCall,
+  isManualTransactionText,
+  isOwnerFile,
+  isPromiseAllCallee,
+  isStaticallyBounded,
+  mapCallArgument,
+  resolveVariable,
+  sqlStatementBindings,
+  sqlText,
+  templateSqlText,
+  unwrapTs,
+};