eslint-plugin-webhook-safety 0.0.0-stage → 0.2.0

package/dist/index.cjs

@@ -0,0 +1,574 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }// src/utils.ts
+var REPO = "https://github.com/Krrishkumar125/eslint-plugin-webhook-safety";
+var docsUrl = (name) => `${REPO}/blob/main/docs/rules/${name}.md`;
+var WEBHOOK_PATH = /webhook|\/hooks?(?:\/|$)/i;
+var CONSTRUCT_EVENT = /* @__PURE__ */ new Set(["constructEvent", "constructEventAsync"]);
+var ROUTE_METHODS = /* @__PURE__ */ new Set(["post", "put", "all"]);
+function isFunction(node) {
+  return !!node && (node.type === "FunctionDeclaration" || node.type === "FunctionExpression" || node.type === "ArrowFunctionExpression");
+}
+function walk(root, visit) {
+  const stack = [root];
+  while (stack.length) {
+    const node = stack.pop();
+    visit(node);
+    for (const key of Object.keys(node)) {
+      if (key === "parent") continue;
+      const value = node[key];
+      const children = Array.isArray(value) ? value : [value];
+      for (const child of children) {
+        if (child && typeof child === "object" && typeof child.type === "string") {
+          stack.push(child);
+        }
+      }
+    }
+  }
+}
+function calleeName(node) {
+  const callee = node.callee;
+  if (callee.type === "Identifier") return callee.name;
+  if (callee.type === "MemberExpression" && !callee.computed && callee.property.type === "Identifier") {
+    return callee.property.name;
+  }
+  return void 0;
+}
+function memberCall(node) {
+  if (node.type !== "CallExpression") return void 0;
+  const callee = node.callee;
+  if (callee.type === "MemberExpression" && !callee.computed && callee.object.type === "Identifier" && callee.property.type === "Identifier") {
+    return [callee.object.name, callee.property.name];
+  }
+  return void 0;
+}
+var PARSER_OWNERS = /* @__PURE__ */ new Set(["express", "bodyParser", "bodyparser"]);
+function isJsonParser(node) {
+  const m = memberCall(node);
+  return !!m && PARSER_OWNERS.has(m[0]) && m[1] === "json";
+}
+function isRawParser(node) {
+  const m = memberCall(node);
+  return !!m && PARSER_OWNERS.has(m[0]) && (m[1] === "raw" || m[1] === "text");
+}
+function isBodyParser(node) {
+  const m = memberCall(node);
+  return !!m && PARSER_OWNERS.has(m[0]) && ["json", "raw", "text", "urlencoded"].includes(m[1]);
+}
+function isConstructEvent(node) {
+  if (node.type !== "CallExpression") return false;
+  const name = calleeName(node);
+  return !!name && CONSTRUCT_EVENT.has(name);
+}
+function findAll(root, test) {
+  const out = [];
+  walk(root, (n) => {
+    if (test(n)) out.push(n);
+  });
+  return out;
+}
+function enclosingFunction(node) {
+  let cur = node.parent;
+  while (cur) {
+    if (isFunction(cur)) return cur;
+    cur = cur.parent;
+  }
+  return void 0;
+}
+function literalString(node) {
+  if (!node) return void 0;
+  if (node.type === "Literal" && typeof node.value === "string") return node.value;
+  if (node.type === "TemplateLiteral" && node.expressions.length === 0) {
+    return _nullishCoalesce(_optionalChain([node, 'access', _ => _.quasis, 'access', _2 => _2[0], 'optionalAccess', _3 => _3.value, 'access', _4 => _4.cooked]), () => ( void 0));
+  }
+  return void 0;
+}
+function asRoute(node) {
+  if (node.type !== "CallExpression") return void 0;
+  const callee = node.callee;
+  if (callee.type !== "MemberExpression" || callee.computed || callee.property.type !== "Identifier") {
+    return void 0;
+  }
+  if (!ROUTE_METHODS.has(callee.property.name)) return void 0;
+  const args = node.arguments;
+  const path = literalString(args[0]);
+  const handler = args[args.length - 1];
+  if (path === void 0 || args.length < 2 || !isFunction(handler)) return void 0;
+  return {
+    call: node,
+    owner: callee.object.type === "Identifier" ? callee.object.name : void 0,
+    path,
+    middlewares: args.slice(1, -1),
+    handler
+  };
+}
+function isNextPostHandler(fn) {
+  const parent = fn.parent;
+  if (fn.type === "FunctionDeclaration") {
+    return _optionalChain([fn, 'access', _5 => _5.id, 'optionalAccess', _6 => _6.name]) === "POST" && _optionalChain([parent, 'optionalAccess', _7 => _7.type]) === "ExportNamedDeclaration";
+  }
+  if (_optionalChain([parent, 'optionalAccess', _8 => _8.type]) === "VariableDeclarator") {
+    return parent.id.type === "Identifier" && parent.id.name === "POST" && _optionalChain([parent, 'access', _9 => _9.parent, 'optionalAccess', _10 => _10.parent, 'optionalAccess', _11 => _11.type]) === "ExportNamedDeclaration";
+  }
+  return false;
+}
+function isWebhookFile(context) {
+  return WEBHOOK_PATH.test(context.filename.replace(/\\/g, "/"));
+}
+function eventBinding(call) {
+  let cur = call.parent;
+  if (_optionalChain([cur, 'optionalAccess', _12 => _12.type]) === "AwaitExpression") cur = cur.parent;
+  let target;
+  if (_optionalChain([cur, 'optionalAccess', _13 => _13.type]) === "VariableDeclarator") target = cur.id;
+  else if (_optionalChain([cur, 'optionalAccess', _14 => _14.type]) === "AssignmentExpression") target = cur.left;
+  if (!target) return void 0;
+  if (target.type === "Identifier") return { kind: "identifier", name: target.name };
+  if (target.type === "ObjectPattern") {
+    const hasId = target.properties.some(
+      (p) => p.type === "RestElement" || p.key.type === "Identifier" && p.key.name === "id" || p.key.type === "Literal" && p.key.value === "id"
+    );
+    return { kind: "pattern", hasId };
+  }
+  return void 0;
+}
+
+// src/rules/bullmq-require-job-id.ts
+var QUEUE_NAME = /queue$/i;
+var rule = {
+  meta: {
+    type: "problem",
+    hasSuggestions: true,
+    docs: {
+      description: "Require a jobId (or deduplication id) when a webhook handler adds a BullMQ job, so retried deliveries do not enqueue duplicates",
+      recommended: true,
+      url: docsUrl("bullmq-require-job-id")
+    },
+    schema: [],
+    messages: {
+      missing: "Webhook deliveries are retried, so this queue.add() will enqueue the same work twice. Pass a stable jobId such as the event id.",
+      addJobId: "Add { jobId: {{name}}.id }"
+    }
+  },
+  create(context) {
+    const webhookFile = isWebhookFile(context);
+    const queues = /* @__PURE__ */ new Set();
+    function isWebhookFunction(fn) {
+      const parent = fn.parent;
+      if (parent) {
+        const route = asRoute(parent);
+        if (route && route.handler === fn && WEBHOOK_PATH.test(route.path)) return true;
+      }
+      if (webhookFile && isNextPostHandler(fn)) return true;
+      return findAll(fn, isConstructEvent).some((c) => enclosingFunction(c) === fn);
+    }
+    function eventName(fn) {
+      for (const c of findAll(fn, isConstructEvent)) {
+        const b = eventBinding(c);
+        if (_optionalChain([b, 'optionalAccess', _15 => _15.kind]) === "identifier") return b.name;
+      }
+      return void 0;
+    }
+    function isQueue(obj) {
+      if (obj.type === "Identifier") return queues.has(obj.name) || QUEUE_NAME.test(obj.name);
+      return obj.type === "MemberExpression" && !obj.computed && obj.property.type === "Identifier" && QUEUE_NAME.test(obj.property.name);
+    }
+    return {
+      VariableDeclarator(node) {
+        if (node.id.type === "Identifier" && _optionalChain([node, 'access', _16 => _16.init, 'optionalAccess', _17 => _17.type]) === "NewExpression" && node.init.callee.type === "Identifier" && node.init.callee.name === "Queue") {
+          queues.add(node.id.name);
+        }
+      },
+      CallExpression(node) {
+        const callee = node.callee;
+        if (callee.type !== "MemberExpression" || callee.computed || callee.property.type !== "Identifier" || callee.property.name !== "add" || node.arguments.length < 2 || node.arguments.length > 3 || !isQueue(callee.object)) {
+          return;
+        }
+        const opts = node.arguments[2];
+        if (opts && opts.type !== "ObjectExpression") return;
+        if (_optionalChain([opts, 'optionalAccess', _18 => _18.type]) === "ObjectExpression" && opts.properties.some(
+          (p) => p.type === "SpreadElement" || p.key.type === "Identifier" && ["jobId", "deduplication"].includes(p.key.name)
+        )) {
+          return;
+        }
+        let fn = enclosingFunction(node);
+        let webhookFn;
+        while (fn) {
+          if (isWebhookFunction(fn)) {
+            webhookFn = fn;
+            break;
+          }
+          fn = enclosingFunction(fn);
+        }
+        if (!webhookFn) return;
+        const name = eventName(webhookFn);
+        const suggest = [];
+        if (name) {
+          const prop = `jobId: ${name}.id`;
+          suggest.push({
+            messageId: "addJobId",
+            data: { name },
+            fix: (fixer) => {
+              if (!opts)
+                return fixer.insertTextAfter(node.arguments[1], `, { ${prop} }`);
+              const obj = opts;
+              const last = obj.properties[obj.properties.length - 1];
+              return last ? fixer.insertTextAfter(last, `, ${prop}`) : fixer.replaceText(obj, `{ ${prop} }`);
+            }
+          });
+        }
+        context.report({ node, messageId: "missing", suggest });
+      }
+    };
+  }
+};
+var bullmq_require_job_id_default = rule;
+
+// src/rules/require-idempotency.ts
+var DEFAULT_HELPERS = /idempot|dedup|processed|alreadyHandled|seenEvent/i;
+var SIDE_EFFECT_METHODS = /* @__PURE__ */ new Set([
+  "create",
+  "createMany",
+  "insert",
+  "insertOne",
+  "insertMany",
+  "update",
+  "updateOne",
+  "updateMany",
+  "upsert",
+  "delete",
+  "deleteMany",
+  "increment",
+  "decrement",
+  "save",
+  "add",
+  "addBulk",
+  "enqueue",
+  "publish",
+  "send",
+  "sendMail",
+  "sendEmail",
+  "charge",
+  "capture",
+  "refund",
+  "transfer"
+]);
+var NON_EFFECT_OBJECTS = /* @__PURE__ */ new Set([
+  "console",
+  "Response",
+  "NextResponse",
+  "JSON",
+  "res",
+  "Math",
+  "Object",
+  "Array"
+]);
+function rootObject(node) {
+  let cur = node;
+  while (cur.type === "MemberExpression" || cur.type === "CallExpression") {
+    cur = cur.type === "MemberExpression" ? cur.object : cur.callee;
+  }
+  return cur;
+}
+var rule2 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Suggest a duplicate-event check (using event.id) before a webhook handler performs side effects directly",
+      recommended: true,
+      url: docsUrl("require-idempotency")
+    },
+    schema: [
+      {
+        type: "object",
+        properties: {
+          idempotencyFunctions: { type: "array", items: { type: "string" } },
+          strict: { type: "boolean" }
+        },
+        additionalProperties: false
+      }
+    ],
+    messages: {
+      missing: "Consider a duplicate-event check: Stripe can deliver `{{name}}` more than once, and this write runs without any use of `{{name}}.id`. Record processed event ids (unique insert) before side effects, or ignore if this write is idempotent. See {{url}}"
+    }
+  },
+  create(context) {
+    const options = _nullishCoalesce(context.options[0], () => ( {}));
+    const helpers = new Set(_nullishCoalesce(options.idempotencyFunctions, () => ( [])));
+    const url = docsUrl("require-idempotency");
+    function isSideEffect(call) {
+      const callee = call.callee;
+      if (callee.type === "MemberExpression") {
+        const root = rootObject(callee);
+        if (root.type === "Identifier" && NON_EFFECT_OBJECTS.has(root.name)) return false;
+        const name = calleeName(call);
+        if (name && SIDE_EFFECT_METHODS.has(name)) return true;
+      }
+      return !!options.strict && !isConstructEvent(call) && call.arguments.length > 0;
+    }
+    return {
+      CallExpression(node) {
+        if (!isConstructEvent(node)) return;
+        const binding = eventBinding(node);
+        if (!binding) return;
+        if (binding.kind === "pattern" && binding.hasId) return;
+        const name = binding.kind === "identifier" ? binding.name : "event";
+        const fn = enclosingFunction(node);
+        if (!fn) return;
+        const after = _nullishCoalesce(_optionalChain([node, 'access', _19 => _19.range, 'optionalAccess', _20 => _20[1]]), () => ( 0));
+        let handled = false;
+        let firstEffect;
+        walk(fn, (n) => {
+          if (handled) return;
+          if (n.type === "MemberExpression" && n.object.type === "Identifier" && n.object.name === name && !n.computed && n.property.type === "Identifier" && n.property.name === "id") {
+            handled = true;
+          } else if (n.type === "ReturnStatement" && _optionalChain([n, 'access', _21 => _21.argument, 'optionalAccess', _22 => _22.type]) === "Identifier" && n.argument.name === name || n.type === "ArrowFunctionExpression" && n.body.type === "Identifier" && n.body.name === name) {
+            handled = true;
+          } else if (n.type === "CallExpression") {
+            const callee = calleeName(n);
+            if (callee && (helpers.has(callee) || DEFAULT_HELPERS.test(callee))) handled = true;
+            const isConsole = n.callee.type === "MemberExpression" && n.callee.object.type === "Identifier" && n.callee.object.name === "console";
+            if (!isConsole && n.arguments.some((a) => a.type === "Identifier" && a.name === name)) {
+              handled = true;
+            }
+            if ((_nullishCoalesce(_optionalChain([n, 'access', _23 => _23.range, 'optionalAccess', _24 => _24[0]]), () => ( 0))) >= after && isSideEffect(n) && (!firstEffect || (_nullishCoalesce(_optionalChain([n, 'access', _25 => _25.range, 'optionalAccess', _26 => _26[0]]), () => ( 0))) < (_nullishCoalesce(_optionalChain([firstEffect, 'access', _27 => _27.range, 'optionalAccess', _28 => _28[0]]), () => ( 0))))) {
+              firstEffect = n;
+            }
+          }
+        });
+        if (!handled && firstEffect) {
+          context.report({ node: firstEffect, messageId: "missing", data: { name, url } });
+        }
+      }
+    };
+  }
+};
+var require_idempotency_default = rule2;
+
+// src/rules/require-raw-body.ts
+function parsesAway(node) {
+  if (!isJsonParser(node)) return false;
+  const opts = node.arguments[0];
+  return !(_optionalChain([opts, 'optionalAccess', _29 => _29.type]) === "ObjectExpression" && opts.properties.some(
+    (p) => p.type === "Property" && p.key.type === "Identifier" && p.key.name === "verify"
+  ));
+}
+function usesParsedBody(fn) {
+  return findAll(fn, isConstructEvent).some((c) => {
+    const payload = c.arguments[0];
+    return _optionalChain([payload, 'optionalAccess', _30 => _30.type]) === "MemberExpression" && !payload.computed && payload.property.type === "Identifier" && payload.property.name === "body";
+  });
+}
+var rule3 = {
+  meta: {
+    type: "problem",
+    hasSuggestions: true,
+    docs: {
+      description: "Require the raw request body for Stripe signature verification (no JSON parsing before constructEvent)",
+      recommended: true,
+      url: docsUrl("require-raw-body")
+    },
+    schema: [],
+    messages: {
+      jsonMiddleware: "express.json() parses the body before the Stripe signature check, so constructEvent will always fail. Use express.raw() on this route.",
+      globalJson: "`{{owner}}.use(express.json())` on line {{line}} runs before this webhook route and parses the body, so constructEvent will fail. Register the webhook route first or give it express.raw().",
+      parsedJson: "The body is parsed with .json() before the Stripe signature check. Read the raw body with .text() and pass it to constructEvent.",
+      stringified: "JSON.stringify() of a parsed body is not byte-identical to what Stripe signed. Pass the raw body string or Buffer.",
+      useRaw: "Replace with express.raw({ type: 'application/json' })",
+      useText: "Read the body with .text() instead"
+    }
+  },
+  create(context) {
+    const globalParsers = [];
+    function handlerVerifies(fn) {
+      return findAll(fn, isConstructEvent).length > 0;
+    }
+    return {
+      CallExpression(node) {
+        const n = node;
+        const callee = n.callee;
+        if (callee.type === "MemberExpression" && !callee.computed && callee.property.type === "Identifier" && callee.property.name === "use" && callee.object.type === "Identifier") {
+          const args = n.arguments;
+          const first = args[0];
+          const pathless = !(_optionalChain([first, 'optionalAccess', _31 => _31.type]) === "Literal" && first.value !== "/");
+          if (pathless && args.some(parsesAway)) {
+            globalParsers.push({ owner: callee.object.name, node: n });
+          }
+        }
+        const route = asRoute(n);
+        if (route && handlerVerifies(route.handler) && usesParsedBody(route.handler)) {
+          const inlineJson = route.middlewares.filter(parsesAway);
+          for (const mw of inlineJson) {
+            context.report({
+              node: mw,
+              messageId: "jsonMiddleware",
+              suggest: [
+                {
+                  messageId: "useRaw",
+                  fix: (fixer) => fixer.replaceText(mw, "express.raw({ type: 'application/json' })")
+                }
+              ]
+            });
+          }
+          if (!inlineJson.length && !route.middlewares.some(isRawParser)) {
+            const earlier = globalParsers.find(
+              (p) => p.owner === route.owner && (_nullishCoalesce(_optionalChain([p, 'access', _32 => _32.node, 'access', _33 => _33.range, 'optionalAccess', _34 => _34[0]]), () => ( 0))) < (_nullishCoalesce(_optionalChain([n, 'access', _35 => _35.range, 'optionalAccess', _36 => _36[0]]), () => ( 0)))
+            );
+            if (earlier) {
+              context.report({
+                node: n,
+                messageId: "globalJson",
+                data: { owner: earlier.owner, line: String(_optionalChain([earlier, 'access', _37 => _37.node, 'access', _38 => _38.loc, 'optionalAccess', _39 => _39.start, 'access', _40 => _40.line])) }
+              });
+            }
+          }
+        }
+        if (isConstructEvent(n)) {
+          const payload = n.arguments[0];
+          if (_optionalChain([payload, 'optionalAccess', _41 => _41.type]) === "CallExpression" && payload.callee.type === "MemberExpression" && payload.callee.object.type === "Identifier" && payload.callee.object.name === "JSON" && payload.callee.property.type === "Identifier" && payload.callee.property.name === "stringify") {
+            context.report({ node: payload, messageId: "stringified" });
+          }
+          const fn = enclosingFunction(n);
+          if (!fn) return;
+          const params = new Set(
+            fn.params.flatMap((p) => p.type === "Identifier" ? [p.name] : [])
+          );
+          const isRequest = (obj) => obj.type === "Identifier" && params.has(obj.name) || obj.type === "MemberExpression" && obj.object.type === "Identifier" && params.has(obj.object.name) && obj.property.type === "Identifier" && obj.property.name === "req";
+          walkSameFunction(fn, (c) => {
+            if (c.type === "CallExpression" && c.arguments.length === 0 && c.callee.type === "MemberExpression" && !c.callee.computed && c.callee.property.type === "Identifier" && c.callee.property.name === "json" && isRequest(c.callee.object) && (_nullishCoalesce(_optionalChain([c, 'access', _42 => _42.range, 'optionalAccess', _43 => _43[0]]), () => ( 0))) < (_nullishCoalesce(_optionalChain([n, 'access', _44 => _44.range, 'optionalAccess', _45 => _45[0]]), () => ( 0)))) {
+              const prop = c.callee.property;
+              context.report({
+                node: c,
+                messageId: "parsedJson",
+                suggest: [
+                  { messageId: "useText", fix: (fixer) => fixer.replaceText(prop, "text") }
+                ]
+              });
+            }
+          });
+        }
+      }
+    };
+  }
+};
+function walkSameFunction(fn, visit) {
+  const body = fn.body;
+  const stack = [body];
+  while (stack.length) {
+    const node = stack.pop();
+    visit(node);
+    for (const key of Object.keys(node)) {
+      if (key === "parent") continue;
+      const value = node[key];
+      for (const child of Array.isArray(value) ? value : [value]) {
+        if (child && typeof child === "object" && typeof child.type === "string") {
+          if (!isFunction(child)) stack.push(child);
+        }
+      }
+    }
+  }
+}
+var require_raw_body_default = rule3;
+
+// src/rules/require-signature-verification.ts
+var DEFAULT_VERIFY = /verif|signature|constructEvent|timingSafeEqual|unwrap/i;
+var AUTH_CALL = /auth|session|apiKey|permission|currentUser|requireUser/i;
+var rule4 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Require webhook handlers to verify the request signature",
+      recommended: true,
+      url: docsUrl("require-signature-verification")
+    },
+    schema: [
+      {
+        type: "object",
+        properties: { verifyFunctions: { type: "array", items: { type: "string" } } },
+        additionalProperties: false
+      }
+    ],
+    messages: {
+      missing: "This webhook handler never verifies the request signature, so anyone can forge events. Call stripe.webhooks.constructEvent() (or your provider\u2019s verify function) before trusting the body."
+    }
+  },
+  create(context) {
+    const extra = new Set(
+      _nullishCoalesce(_optionalChain([context, 'access', _46 => _46.options, 'access', _47 => _47[0], 'optionalAccess', _48 => _48.verifyFunctions]), () => ( []))
+    );
+    const webhookFile = isWebhookFile(context);
+    function verifies(fn) {
+      let found = false;
+      const params = new Set(
+        fn.params.flatMap((p) => p.type === "Identifier" ? [p.name] : [])
+      );
+      const isRequest = (a) => a.type === "Identifier" && params.has(a.name) || a.type === "MemberExpression" && a.object.type === "Identifier" && params.has(a.object.name) && !a.computed && a.property.type === "Identifier" && a.property.name === "req";
+      walk(fn, (n) => {
+        if (found || n.type !== "CallExpression" && n.type !== "NewExpression") return;
+        const root = n.callee.type === "MemberExpression" ? n.callee.object : void 0;
+        const builtin = _optionalChain([root, 'optionalAccess', _49 => _49.type]) === "Identifier" && ["console", "JSON", "Response", "NextResponse", "res", "Object"].includes(root.name);
+        if (!builtin && n.arguments.some(isRequest)) {
+          found = true;
+          return;
+        }
+        const name = calleeName(n);
+        if (name && (extra.has(name) || DEFAULT_VERIFY.test(name) || AUTH_CALL.test(name)))
+          found = true;
+      });
+      return found;
+    }
+    function check(fn) {
+      if (!verifies(fn)) context.report({ node: fn, messageId: "missing" });
+    }
+    return {
+      CallExpression(node) {
+        const route = asRoute(node);
+        if (!route || !WEBHOOK_PATH.test(route.path)) return;
+        if (route.middlewares.some((m) => !isBodyParser(m))) return;
+        check(route.handler);
+      },
+      "FunctionDeclaration, FunctionExpression, ArrowFunctionExpression"(node) {
+        if (webhookFile && isNextPostHandler(node)) check(node);
+      }
+    };
+  }
+};
+var require_signature_verification_default = rule4;
+
+// src/index.ts
+var rules = {
+  "require-raw-body": require_raw_body_default,
+  "require-signature-verification": require_signature_verification_default,
+  "require-idempotency": require_idempotency_default,
+  "bullmq-require-job-id": bullmq_require_job_id_default
+};
+var recommendedRules = {
+  "webhook-safety/require-raw-body": "error",
+  "webhook-safety/require-signature-verification": "error",
+  "webhook-safety/require-idempotency": "warn",
+  "webhook-safety/bullmq-require-job-id": "warn"
+};
+var strictRules = Object.fromEntries(
+  Object.keys(recommendedRules).map((k) => [k, "error"])
+);
+var plugin = {
+  meta: { name: "eslint-plugin-webhook-safety", version: "0.2.0" },
+  rules,
+  configs: {}
+};
+plugin.configs.recommended = {
+  name: "webhook-safety/recommended",
+  plugins: { "webhook-safety": plugin },
+  rules: recommendedRules
+};
+plugin.configs.strict = {
+  name: "webhook-safety/strict",
+  plugins: { "webhook-safety": plugin },
+  rules: strictRules
+};
+plugin.configs["legacy-recommended"] = { plugins: ["webhook-safety"], rules: recommendedRules };
+plugin.configs["legacy-strict"] = { plugins: ["webhook-safety"], rules: strictRules };
+var index_default = plugin;
+
+
+exports.default = index_default;
+
+module.exports = exports.default;
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/workspace/eslint-plugin-webhook-safety/dist/index.cjs","../src/utils.ts","../src/rules/bullmq-require-job-id.ts","../src/rules/require-idempotency.ts","../src/rules/require-raw-body.ts","../src/rules/require-signature-verification.ts","../src/index.ts"],"names":[],"mappings":"AAAA;ACOA,IAAM,KAAA,EAAO,gEAAA;AACN,IAAM,QAAA,EAAU,CAAC,IAAA,EAAA,GAAyB,CAAA,EAAA;AAErB;AACJ;AACF;AAGpB;AAIQ,EAAA;AAIV;AAGiC;AACJ,EAAA;AACN,EAAA;AACA,IAAA;AACT,IAAA;AACQ,IAAA;AACJ,MAAA;AAC+C,MAAA;AAC1C,MAAA;AACN,MAAA;AACI,QAAA;AACA,UAAA;AACb,QAAA;AACF,MAAA;AACF,IAAA;AACF,EAAA;AACF;AAG2B;AACL,EAAA;AACA,EAAA;AAEF,EAAA;AAIF,IAAA;AAChB,EAAA;AACO,EAAA;AACT;AAG2B;AACP,EAAA;AACE,EAAA;AAEF,EAAA;AAKD,IAAA;AACjB,EAAA;AACO,EAAA;AACT;AAEsB;AACO;AACN,EAAA;AACP,EAAA;AAChB;AAC4B;AACL,EAAA;AACP,EAAA;AAChB;AAC6B;AACN,EAAA;AACP,EAAA;AAChB;AAEgB;AACI,EAAA;AACL,EAAA;AACI,EAAA;AACnB;AAEoD;AAChC,EAAA;AACA,EAAA;AACC,IAAA;AAClB,EAAA;AACM,EAAA;AACT;AAEgB;AACC,EAAA;AACH,EAAA;AACW,IAAA;AACX,IAAA;AACZ,EAAA;AACO,EAAA;AACT;AAEuB;AACH,EAAA;AACA,EAAA;AACA,EAAA;AACI,IAAA;AACtB,EAAA;AACO,EAAA;AACT;AAYuD;AACnC,EAAA;AACE,EAAA;AAEF,EAAA;AAIT,IAAA;AACT,EAAA;AACuB,EAAA;AACL,EAAA;AACL,EAAA;AACQ,EAAA;AACK,EAAA;AACnB,EAAA;AACC,IAAA;AACe,IAAA;AACrB,IAAA;AACkB,IAAA;AAClB,IAAA;AACF,EAAA;AACF;AAGgB;AACc,EAAA;AACZ,EAAA;AACA,IAAA;AAChB,EAAA;AACqB,EAAA;AAEP,IAAA;AAId,EAAA;AACO,EAAA;AACT;AAE8B;AACR,EAAA;AACtB;AAIE;AAEyB,EAAA;AACP,EAAA;AACd,EAAA;AACc,EAAA;AACK,EAAA;AACH,EAAA;AACA,EAAA;AACA,EAAA;AACG,IAAA;AAEN,MAAA;AAGf,IAAA;AACe,IAAA;AACjB,EAAA;AACO,EAAA;AACT;AD/DyB;AACA;AEpHN;AAEW;AACtB,EAAA;AACE,IAAA;AACU,IAAA;AACV,IAAA;AAEF,MAAA;AACW,MAAA;AACA,MAAA;AACf,IAAA;AACS,IAAA;AACC,IAAA;AAEN,MAAA;AACQ,MAAA;AACZ,IAAA;AACF,EAAA;AACgB,EAAA;AACM,IAAA;AACL,IAAA;AAEN,IAAA;AACqB,MAAA;AAChB,MAAA;AACI,QAAA;AACD,QAAA;AACf,MAAA;AACmB,MAAA;AACQ,MAAA;AAC7B,IAAA;AAEmB,IAAA;AACD,MAAA;AACJ,QAAA;AACM,QAAA;AAClB,MAAA;AACO,MAAA;AACT,IAAA;AAEiB,IAAA;AACE,MAAA;AAEX,MAAA;AAKR,IAAA;AAEO,IAAA;AACc,MAAA;AAEP,QAAA;AAKG,UAAA;AACb,QAAA;AACF,MAAA;AACe,MAAA;AACE,QAAA;AAEN,QAAA;AAQP,UAAA;AACF,QAAA;AACa,QAAA;AACI,QAAA;AAET,QAAA;AAGA,UAAA;AAGN,QAAA;AACA,UAAA;AACF,QAAA;AACS,QAAA;AACL,QAAA;AACO,QAAA;AACL,UAAA;AACU,YAAA;AACZ,YAAA;AACF,UAAA;AACK,UAAA;AACP,QAAA;AACgB,QAAA;AACH,QAAA;AACuC,QAAA;AAC1C,QAAA;AACK,UAAA;AACA,UAAA;AACA,YAAA;AACE,YAAA;AACP,YAAA;AACC,cAAA;AACI,gBAAA;AACH,cAAA;AACA,cAAA;AACC,cAAA;AAGT,YAAA;AACD,UAAA;AACH,QAAA;AACiB,QAAA;AACnB,MAAA;AACF,IAAA;AACF,EAAA;AACF;AAEO;AFqFkB;AACA;AGnND;AAMlB;AACJ,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACD;AAC0B;AACzB,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACD;AAEmB;AACR,EAAA;AACU,EAAA;AACE,IAAA;AACtB,EAAA;AACO,EAAA;AACT;AAE8B;AACtB,EAAA;AACE,IAAA;AACA,IAAA;AAEF,MAAA;AACW,MAAA;AACA,MAAA;AACf,IAAA;AACQ,IAAA;AACN,MAAA;AACQ,QAAA;AACM,QAAA;AACV,UAAA;AACU,UAAA;AACZ,QAAA;AACA,QAAA;AACF,MAAA;AACF,IAAA;AACU,IAAA;AAEN,MAAA;AACJ,IAAA;AACF,EAAA;AACgB,EAAA;AACG,IAAA;AAIG,IAAA;AACA,IAAA;AAEX,IAAA;AACQ,MAAA;AACJ,MAAA;AACI,QAAA;AACJ,QAAA;AACI,QAAA;AACD,QAAA;AACd,MAAA;AAEiB,MAAA;AACnB,IAAA;AAEO,IAAA;AACU,MAAA;AACR,QAAA;AACW,QAAA;AACF,QAAA;AACF,QAAA;AACC,QAAA;AACF,QAAA;AACF,QAAA;AACK,QAAA;AACA,QAAA;AACV,QAAA;AACoB,QAAA;AACT,UAAA;AAEA,UAAA;AAOD,YAAA;AAEP,UAAA;AAQO,YAAA;AACC,UAAA;AACL,YAAA;AACF,YAAA;AACE,YAAA;AAKD,YAAA;AACO,cAAA;AACZ,YAAA;AAEK,YAAA;AAIH,cAAA;AACF,YAAA;AACF,UAAA;AACD,QAAA;AACe,QAAA;AACC,UAAA;AACjB,QAAA;AACF,MAAA;AACF,IAAA;AACF,EAAA;AACF;AAEO;AH8KkB;AACA;AIzUL;AACI,EAAA;AACuB,EAAA;AAErC,EAAA;AAEc,IAAA;AACpB,EAAA;AAEJ;AAGwB;AACH,EAAA;AACC,IAAA;AAEP,IAAA;AAKZ,EAAA;AACH;AAE8B;AACtB,EAAA;AACE,IAAA;AACU,IAAA;AACV,IAAA;AAEF,MAAA;AACW,MAAA;AACA,MAAA;AACf,IAAA;AACS,IAAA;AACC,IAAA;AAEN,MAAA;AAEA,MAAA;AAEA,MAAA;AAEA,MAAA;AACM,MAAA;AACC,MAAA;AACX,IAAA;AACF,EAAA;AACgB,EAAA;AACR,IAAA;AAEG,IAAA;AACY,MAAA;AACrB,IAAA;AAEO,IAAA;AACU,MAAA;AACH,QAAA;AACO,QAAA;AAGR,QAAA;AAMQ,UAAA;AACD,UAAA;AACR,UAAA;AACF,UAAA;AACF,YAAA;AACF,UAAA;AACF,QAAA;AAEc,QAAA;AACD,QAAA;AACL,UAAA;AACK,UAAA;AACD,YAAA;AACA,cAAA;AACK,cAAA;AACF,cAAA;AACP,gBAAA;AACE,kBAAA;AACM,kBAAA;AAER,gBAAA;AACF,cAAA;AACD,YAAA;AACH,UAAA;AACK,UAAA;AACG,YAAA;AACK,cAAA;AACX,YAAA;AACa,YAAA;AACH,cAAA;AACA,gBAAA;AACN,gBAAA;AACQ,gBAAA;AACT,cAAA;AACH,YAAA;AACF,UAAA;AACF,QAAA;AAEI,QAAA;AACI,UAAA;AAEK,UAAA;AAOD,YAAA;AACV,UAAA;AACW,UAAA;AACF,UAAA;AACM,UAAA;AACH,YAAA;AACZ,UAAA;AACM,UAAA;AAON,UAAA;AAEM,YAAA;AASI,cAAA;AACE,cAAA;AACA,gBAAA;AACN,gBAAA;AACS,gBAAA;AACL,kBAAA;AACJ,gBAAA;AACD,cAAA;AACH,YAAA;AACD,UAAA;AACH,QAAA;AACF,MAAA;AACF,IAAA;AACF,EAAA;AACF;AAES;AAC8B,EAAA;AACV,EAAA;AACN,EAAA;AACA,IAAA;AACT,IAAA;AACQ,IAAA;AACJ,MAAA;AAC+C,MAAA;AAChD,MAAA;AACI,QAAA;AACN,UAAA;AACP,QAAA;AACF,MAAA;AACF,IAAA;AACF,EAAA;AACF;AAEO;AJuRkB;AACA;AKvcF;AAEL;AAEY;AACtB,EAAA;AACE,IAAA;AACA,IAAA;AACS,MAAA;AACA,MAAA;AACA,MAAA;AACf,IAAA;AACQ,IAAA;AACN,MAAA;AACQ,QAAA;AACQ,QAAA;AACd,QAAA;AACF,MAAA;AACF,IAAA;AACU,IAAA;AAEN,MAAA;AACJ,IAAA;AACF,EAAA;AACgB,EAAA;AACI,IAAA;AACE,uCAAA;AACpB,IAAA;AACoB,IAAA;AAEF,IAAA;AACJ,MAAA;AACO,MAAA;AACW,QAAA;AAC9B,MAAA;AACmB,MAAA;AAQH,MAAA;AACE,QAAA;AAED,QAAA;AAEb,QAAA;AAEe,QAAA;AACP,UAAA;AACR,UAAA;AACF,QAAA;AACa,QAAA;AACA,QAAA;AACH,UAAA;AACX,MAAA;AACM,MAAA;AACT,IAAA;AAE+B,IAAA;AACV,MAAA;AACrB,IAAA;AAEO,IAAA;AACU,MAAA;AACC,QAAA;AACC,QAAA;AAEL,QAAA;AACE,QAAA;AACd,MAAA;AACA,MAAA;AACM,QAAA;AACN,MAAA;AACF,IAAA;AACF,EAAA;AACF;AAEO;ALubkB;AACA;AMhhBsB;AACzB,EAAA;AACpB,EAAA;AACuB,EAAA;AACvB,EAAA;AACF;AAE6C;AAC3C,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACF;AAC+C;AACjC,EAAA;AACd;AAEe;AACC,EAAA;AACd,EAAA;AACU,EAAA;AAMZ;AAEe;AACP,EAAA;AACK,EAAA;AACJ,EAAA;AACT;AACwB;AAChB,EAAA;AACK,EAAA;AACJ,EAAA;AACT;AACe;AACA;AAEA;ANygBU;AACA;AACA","file":"/workspace/eslint-plugin-webhook-safety/dist/index.cjs","sourcesContent":[null,"import type { Rule } from 'eslint';\nimport type * as ESTree from 'estree';\n\nexport type Node = ESTree.Node & { parent?: Node };\nexport type FunctionNode =\n  ESTree.FunctionDeclaration | ESTree.FunctionExpression | ESTree.ArrowFunctionExpression;\n\nconst REPO = 'https://github.com/Krrishkumar125/eslint-plugin-webhook-safety';\nexport const docsUrl = (name: string): string => `${REPO}/blob/main/docs/rules/${name}.md`;\n\nexport const WEBHOOK_PATH = /webhook|\\/hooks?(?:\\/|$)/i;\nconst CONSTRUCT_EVENT = new Set(['constructEvent', 'constructEventAsync']);\nconst ROUTE_METHODS = new Set(['post', 'put', 'all']);\n\nexport function isFunction(\n  node: Node | null | undefined,\n): node is FunctionNode & { parent?: Node } {\n  return (\n    !!node &&\n    (node.type === 'FunctionDeclaration' ||\n      node.type === 'FunctionExpression' ||\n      node.type === 'ArrowFunctionExpression')\n  );\n}\n\n/** Depth-first walk over every descendant node (including the root). */\nexport function walk(root: Node, visit: (node: Node) => void): void {\n  const stack: Node[] = [root];\n  while (stack.length) {\n    const node = stack.pop() as Node;\n    visit(node);\n    for (const key of Object.keys(node)) {\n      if (key === 'parent') continue;\n      const value = (node as unknown as Record<string, unknown>)[key];\n      const children = Array.isArray(value) ? value : [value];\n      for (const child of children) {\n        if (child && typeof child === 'object' && typeof (child as Node).type === 'string') {\n          stack.push(child as Node);\n        }\n      }\n    }\n  }\n}\n\n/** The name of the called function: `a.b.c()` -> \"c\", `fn()` -> \"fn\". */\nexport function calleeName(node: ESTree.CallExpression | ESTree.NewExpression): string | undefined {\n  const callee = node.callee;\n  if (callee.type === 'Identifier') return callee.name;\n  if (\n    callee.type === 'MemberExpression' &&\n    !callee.computed &&\n    callee.property.type === 'Identifier'\n  ) {\n    return callee.property.name;\n  }\n  return undefined;\n}\n\n/** `express.json()` -> [\"express\", \"json\"] for a simple `object.method()` call. */\nexport function memberCall(node: Node): [string, string] | undefined {\n  if (node.type !== 'CallExpression') return undefined;\n  const callee = node.callee;\n  if (\n    callee.type === 'MemberExpression' &&\n    !callee.computed &&\n    callee.object.type === 'Identifier' &&\n    callee.property.type === 'Identifier'\n  ) {\n    return [callee.object.name, callee.property.name];\n  }\n  return undefined;\n}\n\nconst PARSER_OWNERS = new Set(['express', 'bodyParser', 'bodyparser']);\nexport function isJsonParser(node: Node): boolean {\n  const m = memberCall(node);\n  return !!m && PARSER_OWNERS.has(m[0]) && m[1] === 'json';\n}\nexport function isRawParser(node: Node): boolean {\n  const m = memberCall(node);\n  return !!m && PARSER_OWNERS.has(m[0]) && (m[1] === 'raw' || m[1] === 'text');\n}\nexport function isBodyParser(node: Node): boolean {\n  const m = memberCall(node);\n  return !!m && PARSER_OWNERS.has(m[0]) && ['json', 'raw', 'text', 'urlencoded'].includes(m[1]);\n}\n\nexport function isConstructEvent(node: Node): node is ESTree.CallExpression {\n  if (node.type !== 'CallExpression') return false;\n  const name = calleeName(node);\n  return !!name && CONSTRUCT_EVENT.has(name);\n}\n\nexport function findAll<T extends Node>(root: Node, test: (n: Node) => n is T): T[] {\n  const out: T[] = [];\n  walk(root, (n) => {\n    if (test(n)) out.push(n);\n  });\n  return out;\n}\n\nexport function enclosingFunction(node: Node): FunctionNode | undefined {\n  let cur = node.parent;\n  while (cur) {\n    if (isFunction(cur)) return cur;\n    cur = cur.parent;\n  }\n  return undefined;\n}\n\nfunction literalString(node: Node | undefined): string | undefined {\n  if (!node) return undefined;\n  if (node.type === 'Literal' && typeof node.value === 'string') return node.value;\n  if (node.type === 'TemplateLiteral' && node.expressions.length === 0) {\n    return node.quasis[0]?.value.cooked ?? undefined;\n  }\n  return undefined;\n}\n\nexport interface Route {\n  call: ESTree.CallExpression;\n  /** `app` in `app.post(...)`, when it is a plain identifier. */\n  owner?: string;\n  path: string;\n  middlewares: Node[];\n  handler: FunctionNode;\n}\n\n/** `app.post('/webhook', ...middlewares, handler)` (Express, Hono, Fastify-style routers). */\nexport function asRoute(node: Node): Route | undefined {\n  if (node.type !== 'CallExpression') return undefined;\n  const callee = node.callee;\n  if (\n    callee.type !== 'MemberExpression' ||\n    callee.computed ||\n    callee.property.type !== 'Identifier'\n  ) {\n    return undefined;\n  }\n  if (!ROUTE_METHODS.has(callee.property.name)) return undefined;\n  const args = node.arguments as Node[];\n  const path = literalString(args[0]);\n  const handler = args[args.length - 1];\n  if (path === undefined || args.length < 2 || !isFunction(handler)) return undefined;\n  return {\n    call: node,\n    owner: callee.object.type === 'Identifier' ? callee.object.name : undefined,\n    path,\n    middlewares: args.slice(1, -1),\n    handler,\n  };\n}\n\n/** Exported Next.js App Router `POST` handler, e.g. `export async function POST(req)`. */\nexport function isNextPostHandler(fn: Node): boolean {\n  const parent = (fn as Node).parent;\n  if (fn.type === 'FunctionDeclaration') {\n    return fn.id?.name === 'POST' && parent?.type === 'ExportNamedDeclaration';\n  }\n  if (parent?.type === 'VariableDeclarator') {\n    return (\n      parent.id.type === 'Identifier' &&\n      parent.id.name === 'POST' &&\n      parent.parent?.parent?.type === 'ExportNamedDeclaration'\n    );\n  }\n  return false;\n}\n\nexport function isWebhookFile(context: Rule.RuleContext): boolean {\n  return WEBHOOK_PATH.test(context.filename.replace(/\\\\/g, '/'));\n}\n\n/** Name bound to the result of a constructEvent call, or destructured `id` presence. */\nexport function eventBinding(\n  call: ESTree.CallExpression,\n): { kind: 'identifier'; name: string } | { kind: 'pattern'; hasId: boolean } | undefined {\n  let cur = (call as Node).parent;\n  if (cur?.type === 'AwaitExpression') cur = cur.parent;\n  let target: Node | undefined;\n  if (cur?.type === 'VariableDeclarator') target = cur.id as Node;\n  else if (cur?.type === 'AssignmentExpression') target = cur.left as Node;\n  if (!target) return undefined;\n  if (target.type === 'Identifier') return { kind: 'identifier', name: target.name };\n  if (target.type === 'ObjectPattern') {\n    const hasId = target.properties.some(\n      (p) =>\n        p.type === 'RestElement' ||\n        (p.key.type === 'Identifier' && p.key.name === 'id') ||\n        (p.key.type === 'Literal' && p.key.value === 'id'),\n    );\n    return { kind: 'pattern', hasId };\n  }\n  return undefined;\n}\n","import type { Rule } from 'eslint';\nimport type * as ESTree from 'estree';\nimport {\n  asRoute,\n  docsUrl,\n  eventBinding,\n  enclosingFunction,\n  findAll,\n  isConstructEvent,\n  isNextPostHandler,\n  isWebhookFile,\n  WEBHOOK_PATH,\n  type FunctionNode,\n  type Node,\n} from '../utils.js';\n\nconst QUEUE_NAME = /queue$/i;\n\nconst rule: Rule.RuleModule = {\n  meta: {\n    type: 'problem',\n    hasSuggestions: true,\n    docs: {\n      description:\n        'Require a jobId (or deduplication id) when a webhook handler adds a BullMQ job, so retried deliveries do not enqueue duplicates',\n      recommended: true,\n      url: docsUrl('bullmq-require-job-id'),\n    },\n    schema: [],\n    messages: {\n      missing:\n        'Webhook deliveries are retried, so this queue.add() will enqueue the same work twice. Pass a stable jobId such as the event id.',\n      addJobId: 'Add { jobId: {{name}}.id }',\n    },\n  },\n  create(context) {\n    const webhookFile = isWebhookFile(context);\n    const queues = new Set<string>();\n\n    function isWebhookFunction(fn: FunctionNode): boolean {\n      const parent = (fn as Node).parent;\n      if (parent) {\n        const route = asRoute(parent);\n        if (route && route.handler === fn && WEBHOOK_PATH.test(route.path)) return true;\n      }\n      if (webhookFile && isNextPostHandler(fn as Node)) return true;\n      return findAll(fn as Node, isConstructEvent).some((c) => enclosingFunction(c) === fn);\n    }\n\n    function eventName(fn: FunctionNode): string | undefined {\n      for (const c of findAll(fn as Node, isConstructEvent)) {\n        const b = eventBinding(c);\n        if (b?.kind === 'identifier') return b.name;\n      }\n      return undefined;\n    }\n\n    function isQueue(obj: Node): boolean {\n      if (obj.type === 'Identifier') return queues.has(obj.name) || QUEUE_NAME.test(obj.name);\n      return (\n        obj.type === 'MemberExpression' &&\n        !obj.computed &&\n        obj.property.type === 'Identifier' &&\n        QUEUE_NAME.test(obj.property.name)\n      );\n    }\n\n    return {\n      VariableDeclarator(node) {\n        if (\n          node.id.type === 'Identifier' &&\n          node.init?.type === 'NewExpression' &&\n          node.init.callee.type === 'Identifier' &&\n          node.init.callee.name === 'Queue'\n        ) {\n          queues.add(node.id.name);\n        }\n      },\n      CallExpression(node) {\n        const callee = node.callee;\n        if (\n          callee.type !== 'MemberExpression' ||\n          callee.computed ||\n          callee.property.type !== 'Identifier' ||\n          callee.property.name !== 'add' ||\n          node.arguments.length < 2 ||\n          node.arguments.length > 3 ||\n          !isQueue(callee.object as Node)\n        ) {\n          return;\n        }\n        const opts = node.arguments[2] as Node | undefined;\n        if (opts && opts.type !== 'ObjectExpression') return;\n        if (\n          opts?.type === 'ObjectExpression' &&\n          opts.properties.some(\n            (p) =>\n              p.type === 'SpreadElement' ||\n              (p.key.type === 'Identifier' && ['jobId', 'deduplication'].includes(p.key.name)),\n          )\n        ) {\n          return;\n        }\n        let fn = enclosingFunction(node as Node);\n        let webhookFn: FunctionNode | undefined;\n        while (fn) {\n          if (isWebhookFunction(fn)) {\n            webhookFn = fn;\n            break;\n          }\n          fn = enclosingFunction(fn as Node);\n        }\n        if (!webhookFn) return;\n        const name = eventName(webhookFn);\n        const suggest: Rule.SuggestionReportDescriptor[] = [];\n        if (name) {\n          const prop = `jobId: ${name}.id`;\n          suggest.push({\n            messageId: 'addJobId',\n            data: { name },\n            fix: (fixer) => {\n              if (!opts)\n                return fixer.insertTextAfter(node.arguments[1] as ESTree.Node, `, { ${prop} }`);\n              const obj = opts as ESTree.ObjectExpression;\n              const last = obj.properties[obj.properties.length - 1];\n              return last\n                ? fixer.insertTextAfter(last, `, ${prop}`)\n                : fixer.replaceText(obj, `{ ${prop} }`);\n            },\n          });\n        }\n        context.report({ node, messageId: 'missing', suggest });\n      },\n    };\n  },\n};\n\nexport default rule;\n","import type { Rule } from 'eslint';\nimport type * as ESTree from 'estree';\nimport {\n  calleeName,\n  docsUrl,\n  enclosingFunction,\n  eventBinding,\n  isConstructEvent,\n  walk,\n  type Node,\n} from '../utils.js';\n\nconst DEFAULT_HELPERS = /idempot|dedup|processed|alreadyHandled|seenEvent/i;\n\n/**\n * Methods that write somewhere when called on an object: ORM/DB writes, queue adds, emails and\n * payment API calls (`db.user.update`, `queue.add`, `resend.emails.send`, `stripe.refunds.create`).\n */\nconst SIDE_EFFECT_METHODS = new Set([\n  'create',\n  'createMany',\n  'insert',\n  'insertOne',\n  'insertMany',\n  'update',\n  'updateOne',\n  'updateMany',\n  'upsert',\n  'delete',\n  'deleteMany',\n  'increment',\n  'decrement',\n  'save',\n  'add',\n  'addBulk',\n  'enqueue',\n  'publish',\n  'send',\n  'sendMail',\n  'sendEmail',\n  'charge',\n  'capture',\n  'refund',\n  'transfer',\n]);\nconst NON_EFFECT_OBJECTS = new Set([\n  'console',\n  'Response',\n  'NextResponse',\n  'JSON',\n  'res',\n  'Math',\n  'Object',\n  'Array',\n]);\n\nfunction rootObject(node: Node): Node {\n  let cur = node;\n  while (cur.type === 'MemberExpression' || cur.type === 'CallExpression') {\n    cur = (cur.type === 'MemberExpression' ? cur.object : cur.callee) as Node;\n  }\n  return cur;\n}\n\nconst rule: Rule.RuleModule = {\n  meta: {\n    type: 'suggestion',\n    docs: {\n      description:\n        'Suggest a duplicate-event check (using event.id) before a webhook handler performs side effects directly',\n      recommended: true,\n      url: docsUrl('require-idempotency'),\n    },\n    schema: [\n      {\n        type: 'object',\n        properties: {\n          idempotencyFunctions: { type: 'array', items: { type: 'string' } },\n          strict: { type: 'boolean' },\n        },\n        additionalProperties: false,\n      },\n    ],\n    messages: {\n      missing:\n        'Consider a duplicate-event check: Stripe can deliver `{{name}}` more than once, and this write runs without any use of `{{name}}.id`. Record processed event ids (unique insert) before side effects, or ignore if this write is idempotent. See {{url}}',\n    },\n  },\n  create(context) {\n    const options = (context.options[0] ?? {}) as {\n      idempotencyFunctions?: string[];\n      strict?: boolean;\n    };\n    const helpers = new Set<string>(options.idempotencyFunctions ?? []);\n    const url = docsUrl('require-idempotency');\n\n    function isSideEffect(call: ESTree.CallExpression): boolean {\n      const callee = call.callee as Node;\n      if (callee.type === 'MemberExpression') {\n        const root = rootObject(callee);\n        if (root.type === 'Identifier' && NON_EFFECT_OBJECTS.has(root.name)) return false;\n        const name = calleeName(call);\n        if (name && SIDE_EFFECT_METHODS.has(name)) return true;\n      }\n      // Helper calls (local or imported) may dedupe internally, so only count them in strict mode.\n      return !!options.strict && !isConstructEvent(call as Node) && call.arguments.length > 0;\n    }\n\n    return {\n      CallExpression(node) {\n        if (!isConstructEvent(node as Node)) return;\n        const binding = eventBinding(node);\n        if (!binding) return;\n        if (binding.kind === 'pattern' && binding.hasId) return;\n        const name = binding.kind === 'identifier' ? binding.name : 'event';\n        const fn = enclosingFunction(node as Node);\n        if (!fn) return;\n        const after = node.range?.[1] ?? 0;\n        let handled = false;\n        let firstEffect: ESTree.CallExpression | undefined;\n        walk(fn as Node, (n) => {\n          if (handled) return;\n          if (\n            n.type === 'MemberExpression' &&\n            n.object.type === 'Identifier' &&\n            n.object.name === name &&\n            !n.computed &&\n            n.property.type === 'Identifier' &&\n            n.property.name === 'id'\n          ) {\n            handled = true;\n          } else if (\n            (n.type === 'ReturnStatement' &&\n              n.argument?.type === 'Identifier' &&\n              n.argument.name === name) ||\n            (n.type === 'ArrowFunctionExpression' &&\n              n.body.type === 'Identifier' &&\n              n.body.name === name)\n          ) {\n            // A wrapper that only verifies and returns the event; the caller handles duplicates.\n            handled = true;\n          } else if (n.type === 'CallExpression') {\n            const callee = calleeName(n);\n            if (callee && (helpers.has(callee) || DEFAULT_HELPERS.test(callee))) handled = true;\n            const isConsole =\n              n.callee.type === 'MemberExpression' &&\n              n.callee.object.type === 'Identifier' &&\n              n.callee.object.name === 'console';\n            // Whole event handed to another function: assume it may dedupe there.\n            if (!isConsole && n.arguments.some((a) => a.type === 'Identifier' && a.name === name)) {\n              handled = true;\n            }\n            if (\n              (n.range?.[0] ?? 0) >= after &&\n              isSideEffect(n) &&\n              (!firstEffect || (n.range?.[0] ?? 0) < (firstEffect.range?.[0] ?? 0))\n            ) {\n              firstEffect = n;\n            }\n          }\n        });\n        if (!handled && firstEffect) {\n          context.report({ node: firstEffect, messageId: 'missing', data: { name, url } });\n        }\n      },\n    };\n  },\n};\n\nexport default rule;\n","import type { Rule } from 'eslint';\nimport type * as ESTree from 'estree';\nimport {\n  asRoute,\n  docsUrl,\n  enclosingFunction,\n  findAll,\n  isConstructEvent,\n  isFunction,\n  isJsonParser,\n  isRawParser,\n  type Node,\n} from '../utils.js';\n\n/** `express.json({ verify })` keeps the raw bytes (usually on `req.rawBody`), so it is fine. */\nfunction parsesAway(node: Node): boolean {\n  if (!isJsonParser(node)) return false;\n  const opts = (node as ESTree.CallExpression).arguments[0];\n  return !(\n    opts?.type === 'ObjectExpression' &&\n    opts.properties.some(\n      (p) => p.type === 'Property' && p.key.type === 'Identifier' && p.key.name === 'verify',\n    )\n  );\n}\n\n/** constructEvent(req.body, ...) somewhere in the handler: the payload is whatever the parser left. */\nfunction usesParsedBody(fn: Node): boolean {\n  return findAll(fn, isConstructEvent).some((c) => {\n    const payload = c.arguments[0];\n    return (\n      payload?.type === 'MemberExpression' &&\n      !payload.computed &&\n      payload.property.type === 'Identifier' &&\n      payload.property.name === 'body'\n    );\n  });\n}\n\nconst rule: Rule.RuleModule = {\n  meta: {\n    type: 'problem',\n    hasSuggestions: true,\n    docs: {\n      description:\n        'Require the raw request body for Stripe signature verification (no JSON parsing before constructEvent)',\n      recommended: true,\n      url: docsUrl('require-raw-body'),\n    },\n    schema: [],\n    messages: {\n      jsonMiddleware:\n        'express.json() parses the body before the Stripe signature check, so constructEvent will always fail. Use express.raw() on this route.',\n      globalJson:\n        '`{{owner}}.use(express.json())` on line {{line}} runs before this webhook route and parses the body, so constructEvent will fail. Register the webhook route first or give it express.raw().',\n      parsedJson:\n        'The body is parsed with .json() before the Stripe signature check. Read the raw body with .text() and pass it to constructEvent.',\n      stringified:\n        'JSON.stringify() of a parsed body is not byte-identical to what Stripe signed. Pass the raw body string or Buffer.',\n      useRaw: \"Replace with express.raw({ type: 'application/json' })\",\n      useText: 'Read the body with .text() instead',\n    },\n  },\n  create(context) {\n    const globalParsers: { owner: string; node: ESTree.CallExpression }[] = [];\n\n    function handlerVerifies(fn: Node): boolean {\n      return findAll(fn, isConstructEvent).length > 0;\n    }\n\n    return {\n      CallExpression(node) {\n        const n = node as Node & ESTree.CallExpression;\n        const callee = n.callee;\n        // app.use(express.json()) / app.use('/', express.json())\n        if (\n          callee.type === 'MemberExpression' &&\n          !callee.computed &&\n          callee.property.type === 'Identifier' &&\n          callee.property.name === 'use' &&\n          callee.object.type === 'Identifier'\n        ) {\n          const args = n.arguments as Node[];\n          const first = args[0];\n          const pathless = !(first?.type === 'Literal' && first.value !== '/');\n          if (pathless && args.some(parsesAway)) {\n            globalParsers.push({ owner: callee.object.name, node: n });\n          }\n        }\n\n        const route = asRoute(n);\n        if (route && handlerVerifies(route.handler) && usesParsedBody(route.handler)) {\n          const inlineJson = route.middlewares.filter(parsesAway);\n          for (const mw of inlineJson) {\n            context.report({\n              node: mw,\n              messageId: 'jsonMiddleware',\n              suggest: [\n                {\n                  messageId: 'useRaw',\n                  fix: (fixer) =>\n                    fixer.replaceText(mw, \"express.raw({ type: 'application/json' })\"),\n                },\n              ],\n            });\n          }\n          if (!inlineJson.length && !route.middlewares.some(isRawParser)) {\n            const earlier = globalParsers.find(\n              (p) => p.owner === route.owner && (p.node.range?.[0] ?? 0) < (n.range?.[0] ?? 0),\n            );\n            if (earlier) {\n              context.report({\n                node: n,\n                messageId: 'globalJson',\n                data: { owner: earlier.owner, line: String(earlier.node.loc?.start.line) },\n              });\n            }\n          }\n        }\n\n        if (isConstructEvent(n)) {\n          const payload = n.arguments[0] as Node | undefined;\n          if (\n            payload?.type === 'CallExpression' &&\n            payload.callee.type === 'MemberExpression' &&\n            payload.callee.object.type === 'Identifier' &&\n            payload.callee.object.name === 'JSON' &&\n            payload.callee.property.type === 'Identifier' &&\n            payload.callee.property.name === 'stringify'\n          ) {\n            context.report({ node: payload, messageId: 'stringified' });\n          }\n          const fn = enclosingFunction(n);\n          if (!fn) return;\n          const params = new Set(\n            fn.params.flatMap((p) => (p.type === 'Identifier' ? [p.name] : [])),\n          );\n          const isRequest = (obj: Node): boolean =>\n            (obj.type === 'Identifier' && params.has(obj.name)) ||\n            (obj.type === 'MemberExpression' &&\n              obj.object.type === 'Identifier' &&\n              params.has(obj.object.name) &&\n              obj.property.type === 'Identifier' &&\n              obj.property.name === 'req');\n          walkSameFunction(fn, (c) => {\n            if (\n              c.type === 'CallExpression' &&\n              c.arguments.length === 0 &&\n              c.callee.type === 'MemberExpression' &&\n              !c.callee.computed &&\n              c.callee.property.type === 'Identifier' &&\n              c.callee.property.name === 'json' &&\n              isRequest(c.callee.object as Node) &&\n              (c.range?.[0] ?? 0) < (n.range?.[0] ?? 0)\n            ) {\n              const prop = c.callee.property;\n              context.report({\n                node: c,\n                messageId: 'parsedJson',\n                suggest: [\n                  { messageId: 'useText', fix: (fixer) => fixer.replaceText(prop, 'text') },\n                ],\n              });\n            }\n          });\n        }\n      },\n    };\n  },\n};\n\nfunction walkSameFunction(fn: Node, visit: (n: Node) => void): void {\n  const body = (fn as ESTree.Function).body as Node;\n  const stack: Node[] = [body];\n  while (stack.length) {\n    const node = stack.pop() as Node;\n    visit(node);\n    for (const key of Object.keys(node)) {\n      if (key === 'parent') continue;\n      const value = (node as unknown as Record<string, unknown>)[key];\n      for (const child of Array.isArray(value) ? value : [value]) {\n        if (child && typeof child === 'object' && typeof (child as Node).type === 'string') {\n          if (!isFunction(child as Node)) stack.push(child as Node);\n        }\n      }\n    }\n  }\n}\n\nexport default rule;\n","import type { Rule } from 'eslint';\nimport {\n  asRoute,\n  calleeName,\n  docsUrl,\n  isBodyParser,\n  isNextPostHandler,\n  isWebhookFile,\n  walk,\n  WEBHOOK_PATH,\n  type FunctionNode,\n  type Node,\n} from '../utils.js';\n\nconst DEFAULT_VERIFY = /verif|signature|constructEvent|timingSafeEqual|unwrap/i;\n/** Authenticated endpoints (e.g. a CRUD API for managing webhook subscriptions) are not receivers. */\nconst AUTH_CALL = /auth|session|apiKey|permission|currentUser|requireUser/i;\n\nconst rule: Rule.RuleModule = {\n  meta: {\n    type: 'problem',\n    docs: {\n      description: 'Require webhook handlers to verify the request signature',\n      recommended: true,\n      url: docsUrl('require-signature-verification'),\n    },\n    schema: [\n      {\n        type: 'object',\n        properties: { verifyFunctions: { type: 'array', items: { type: 'string' } } },\n        additionalProperties: false,\n      },\n    ],\n    messages: {\n      missing:\n        'This webhook handler never verifies the request signature, so anyone can forge events. Call stripe.webhooks.constructEvent() (or your provider’s verify function) before trusting the body.',\n    },\n  },\n  create(context) {\n    const extra = new Set<string>(\n      (context.options[0] as { verifyFunctions?: string[] } | undefined)?.verifyFunctions ?? [],\n    );\n    const webhookFile = isWebhookFile(context);\n\n    function verifies(fn: Node): boolean {\n      let found = false;\n      const params = new Set(\n        (fn as FunctionNode).params.flatMap((p) => (p.type === 'Identifier' ? [p.name] : [])),\n      );\n      const isRequest = (a: Node): boolean =>\n        (a.type === 'Identifier' && params.has(a.name)) ||\n        (a.type === 'MemberExpression' &&\n          a.object.type === 'Identifier' &&\n          params.has(a.object.name) &&\n          !a.computed &&\n          a.property.type === 'Identifier' &&\n          a.property.name === 'req');\n      walk(fn, (n) => {\n        if (found || (n.type !== 'CallExpression' && n.type !== 'NewExpression')) return;\n        // The whole request handed to a helper (often in another file) that may verify it.\n        const root = n.callee.type === 'MemberExpression' ? n.callee.object : undefined;\n        const builtin =\n          root?.type === 'Identifier' &&\n          ['console', 'JSON', 'Response', 'NextResponse', 'res', 'Object'].includes(root.name);\n        if (!builtin && (n.arguments as Node[]).some(isRequest)) {\n          found = true;\n          return;\n        }\n        const name = calleeName(n);\n        if (name && (extra.has(name) || DEFAULT_VERIFY.test(name) || AUTH_CALL.test(name)))\n          found = true;\n      });\n      return found;\n    }\n\n    function check(fn: Node): void {\n      if (!verifies(fn)) context.report({ node: fn, messageId: 'missing' });\n    }\n\n    return {\n      CallExpression(node) {\n        const route = asRoute(node as Node);\n        if (!route || !WEBHOOK_PATH.test(route.path)) return;\n        // Any non-body-parser middleware may be doing the verification.\n        if (route.middlewares.some((m) => !isBodyParser(m))) return;\n        check(route.handler);\n      },\n      'FunctionDeclaration, FunctionExpression, ArrowFunctionExpression'(node: Rule.Node) {\n        if (webhookFile && isNextPostHandler(node as Node)) check(node as Node);\n      },\n    };\n  },\n};\n\nexport default rule;\n","import type { ESLint, Linter, Rule } from 'eslint';\nimport bullmqRequireJobId from './rules/bullmq-require-job-id.js';\nimport requireIdempotency from './rules/require-idempotency.js';\nimport requireRawBody from './rules/require-raw-body.js';\nimport requireSignatureVerification from './rules/require-signature-verification.js';\n\nconst rules: Record<string, Rule.RuleModule> = {\n  'require-raw-body': requireRawBody,\n  'require-signature-verification': requireSignatureVerification,\n  'require-idempotency': requireIdempotency,\n  'bullmq-require-job-id': bullmqRequireJobId,\n};\n\nconst recommendedRules: Linter.RulesRecord = {\n  'webhook-safety/require-raw-body': 'error',\n  'webhook-safety/require-signature-verification': 'error',\n  'webhook-safety/require-idempotency': 'warn',\n  'webhook-safety/bullmq-require-job-id': 'warn',\n};\nconst strictRules: Linter.RulesRecord = Object.fromEntries(\n  Object.keys(recommendedRules).map((k) => [k, 'error']),\n);\n\nconst plugin = {\n  meta: { name: 'eslint-plugin-webhook-safety', version: '0.2.0' },\n  rules,\n  configs: {} as {\n    recommended: Linter.Config & { rules: Linter.RulesRecord };\n    strict: Linter.Config & { rules: Linter.RulesRecord };\n    'legacy-recommended': { plugins: string[]; rules: Linter.RulesRecord };\n    'legacy-strict': { plugins: string[]; rules: Linter.RulesRecord };\n  },\n} satisfies ESLint.Plugin;\n\nplugin.configs.recommended = {\n  name: 'webhook-safety/recommended',\n  plugins: { 'webhook-safety': plugin as ESLint.Plugin },\n  rules: recommendedRules,\n};\nplugin.configs.strict = {\n  name: 'webhook-safety/strict',\n  plugins: { 'webhook-safety': plugin as ESLint.Plugin },\n  rules: strictRules,\n};\nplugin.configs['legacy-recommended'] = { plugins: ['webhook-safety'], rules: recommendedRules };\nplugin.configs['legacy-strict'] = { plugins: ['webhook-safety'], rules: strictRules };\n\nexport default plugin;\n"]}