jsxpression 0.1.28 → 0.1.29

package/src/analyze/security/declarations.ts

@@ -1,9 +1,10 @@
 import type { Program } from "acorn";
-import { traverse } from "../../traverse.js";
+import { isJsxRoot } from "../../jsx.js";
 import type { Schema } from "../../schema.js";
-import { ValidationContext } from "../validation-context.js";
+import { traverse } from "../../traverse.js";
 import { AnalysisReport } from "../analysis-report.js";
 import { getNodeRange } from "../utils.js";
+import type { ValidationContext } from "../validation-context.js";
 
 export function analyzeDeclarations(
   ast: Program,
@@ -11,6 +12,7 @@ export function analyzeDeclarations(
   validationContext: ValidationContext
 ): AnalysisReport {
   const analysisReport = new AnalysisReport();
+  const topLevelNodes = new Set(ast.body);
 
   traverse(ast, {
     ImportDeclaration(node) {
@@ -38,12 +40,14 @@ export function analyzeDeclarations(
       );
     },
     FunctionDeclaration(node) {
-      analysisReport.addIssue(
-        "FUNCTION_NOT_ALLOWED",
-        "function declarations not allowed",
-        getNodeRange(node),
-        validationContext.getSnapshot()
-      );
+      if (!topLevelNodes.has(node as any)) {
+        analysisReport.addIssue(
+          "FUNCTION_NOT_ALLOWED",
+          "nested function declarations not allowed",
+          getNodeRange(node),
+          validationContext.getSnapshot()
+        );
+      }
     },
     ClassDeclaration(node) {
       analysisReport.addIssue(
@@ -54,14 +58,36 @@ export function analyzeDeclarations(
       );
     },
     VariableDeclaration(node) {
+      if (node.kind === "const") {
+        return;
+      }
       analysisReport.addIssue(
         "VARIABLE_NOT_ALLOWED",
-        "variables not allowed",
+        `${node.kind} not allowed, use const`,
         getNodeRange(node),
         validationContext.getSnapshot()
       );
     },
   });
 
+  const hasDeclarations = ast.body.some((s) => s.type === "VariableDeclaration" || s.type === "FunctionDeclaration");
+  if (hasDeclarations) {
+    const lastStatement = ast.body[ast.body.length - 1];
+    if (!lastStatement || lastStatement.type !== "ReturnStatement") {
+      const isBareJsx = lastStatement?.type === "ExpressionStatement" && isJsxRoot(lastStatement.expression);
+      const range = lastStatement
+        ? getNodeRange(lastStatement)
+        : { start: { line: 1, column: 0 }, end: { line: 1, column: 0 } };
+      analysisReport.addIssue(
+        "RETURN_REQUIRED",
+        isBareJsx
+          ? "Templates with declarations must end with a return statement. Add 'return' before the JSX."
+          : "Templates with declarations must end with a return statement",
+        range,
+        validationContext.getSnapshot()
+      );
+    }
+  }
+
   return analysisReport;
 }

package/src/analyze/security/expressions.ts

@@ -1,4 +1,4 @@
-import type { Program } from "acorn";
+import type { Program, Expression, Super } from "acorn";
 import { traverse } from "../../traverse.js";
 import type { Schema } from "../../schema.js";
 import { ValidationContext } from "../validation-context.js";
@@ -76,10 +76,24 @@ export function analyzeExpressions(
       }
     },
     MemberExpression(node) {
+      let depth = 0;
+      let currentNode: Expression | Super = node;
+      while (currentNode.type === "MemberExpression") {
+        depth += 1;
+        currentNode = currentNode.object;
+      }
+      if (depth > 5) {
+        analysisReport.addIssue(
+          "MEMBER_CHAIN_TOO_DEEP",
+          "member chain too deep",
+          getNodeRange(node),
+          validationContext.getSnapshot()
+        );
+      }
+
       if (node.computed) {
-        // We allow numeric literals for array access (data.items[0])
         if (node.property.type === "Literal" && typeof node.property.value === "number") {
-          return; // Allow numeric array indices
+          return;
         }
 
         analysisReport.addIssue(

package/src/analyze/security/identifiers.ts

@@ -1,36 +1,71 @@
-import type { AnyNode, ArrowFunctionExpression, Identifier, Program } from "acorn";
-import { traverse } from "../../traverse.js";
-import type { Schema } from "../../schema.js";
+import type { AnyNode, ArrowFunctionExpression, FunctionDeclaration, Identifier, Program } from "acorn";
 import { getBuiltinGlobals } from "../../builtins.js";
-import { ValidationContext } from "../validation-context.js";
+import type { Schema } from "../../schema.js";
+import { traverse } from "../../traverse.js";
 import { AnalysisReport } from "../analysis-report.js";
 import { getNodeRange } from "../utils.js";
+import type { ValidationContext } from "../validation-context.js";
 
-export function analyzeIdentifiers(
-  ast: Program,
-  _schema: Schema,
-  validationContext: ValidationContext
-): AnalysisReport {
+export function analyzeIdentifiers(ast: Program, schema: Schema, validationContext: ValidationContext): AnalysisReport {
   const analysisReport = new AnalysisReport();
   const arrowParamScopes = getArrowParamScopes(ast);
+  const functionParamScopes = getFunctionParamScopes(ast);
+  const functionLocalConsts = getFunctionLocalConsts(ast);
+  const parentMap = buildParentMap(ast);
+
+  const constNames = getTopLevelConstNames(ast);
+  const functionNames = getTopLevelFunctionNames(ast);
+  const schemaFunctionNames = Object.keys(schema.functions ?? {});
 
   traverse(ast, {
     Identifier(node: Identifier) {
       const { name } = node;
 
-      const allowedRoots = ["props", "data", ...getBuiltinGlobals()];
+      const parent = parentMap.get(node);
+      if (parent?.type === "MemberExpression" && parent.property === node && !parent.computed) {
+        return;
+      }
+      if (parent?.type === "Property" && parent.key === node && !parent.computed) {
+        return;
+      }
+      if (parent?.type === "VariableDeclarator" && parent.id === node) {
+        return;
+      }
+      if (parent?.type === "FunctionDeclaration" && parent.id === node) {
+        return;
+      }
+
+      const dataKeys = Object.keys(schema.data ?? {});
+      const allowedRoots = [
+        "props",
+        ...dataKeys,
+        ...getBuiltinGlobals(),
+        ...constNames,
+        ...functionNames,
+        ...schemaFunctionNames,
+      ];
 
       if (allowedRoots.includes(name)) {
         return;
       }
 
-      const arrowParent = findArrowParent(node, ast);
+      const scopeParent = findScopeParent(node, ast);
 
-      if (arrowParent) {
-        const params = arrowParamScopes.get(arrowParent);
+      if (scopeParent) {
+        const params =
+          scopeParent.type === "ArrowFunctionExpression"
+            ? arrowParamScopes.get(scopeParent)
+            : functionParamScopes.get(scopeParent as FunctionDeclaration);
         if (params?.has(name)) {
           return;
         }
+
+        if (scopeParent.type === "FunctionDeclaration") {
+          const localConsts = functionLocalConsts.get(scopeParent as FunctionDeclaration);
+          if (localConsts?.has(name)) {
+            return;
+          }
+        }
       }
 
       analysisReport.addIssue(
@@ -46,10 +81,6 @@ export function analyzeIdentifiers(
   return analysisReport;
 }
 
-// Build a map of arrow functions to their parameter names so we can check if an
-// identifier is a legit arrow function param or something shady. We do this in
-// a separate traversal because it's cleaner than trying to track scope during the
-// main validation pass.
 function getArrowParamScopes(ast: Program): Map<ArrowFunctionExpression, Set<string>> {
   const arrowParamScopes = new Map<ArrowFunctionExpression, Set<string>>();
   traverse(ast, {
@@ -58,9 +89,7 @@ function getArrowParamScopes(ast: Program): Map<ArrowFunctionExpression, Set<str
       if (Array.isArray(params)) {
         const paramNames = new Set<string>();
         params.forEach((p) => {
-          if (p.type === "Identifier") {
-            paramNames.add(p.name);
-          }
+          collectParamNames(p, paramNames);
         });
         arrowParamScopes.set(node, paramNames);
       }
@@ -69,20 +98,107 @@ function getArrowParamScopes(ast: Program): Map<ArrowFunctionExpression, Set<str
   return arrowParamScopes;
 }
 
-// Walk up the AST tree to find the nearest ArrowFunctionExpression parent.
-// This lets us check if an identifier is in scope as an arrow function parameter.
-function findArrowParent(targetNode: AnyNode, rootNode: AnyNode): ArrowFunctionExpression | null {
-  let found: ArrowFunctionExpression | null = null;
+function getFunctionParamScopes(ast: Program): Map<FunctionDeclaration, Set<string>> {
+  const functionParamScopes = new Map<FunctionDeclaration, Set<string>>();
+  traverse(ast, {
+    FunctionDeclaration(node) {
+      const paramNames = new Set<string>();
+      for (const param of node.params) {
+        collectParamNames(param, paramNames);
+      }
+      functionParamScopes.set(node as FunctionDeclaration, paramNames);
+    },
+  });
+  return functionParamScopes;
+}
+
+function getFunctionLocalConsts(ast: Program): Map<FunctionDeclaration, Set<string>> {
+  const map = new Map<FunctionDeclaration, Set<string>>();
+  traverse(ast, {
+    FunctionDeclaration(node) {
+      const names = new Set<string>();
+      const body = (node as FunctionDeclaration).body;
+      if (body?.type === "BlockStatement") {
+        for (const stmt of body.body) {
+          if (stmt.type === "VariableDeclaration" && stmt.kind === "const") {
+            for (const decl of stmt.declarations) {
+              if (decl.id.type === "Identifier") {
+                names.add(decl.id.name);
+              }
+            }
+          }
+        }
+      }
+      map.set(node as FunctionDeclaration, names);
+    },
+  });
+  return map;
+}
+
+function collectParamNames(param: AnyNode, names: Set<string>): void {
+  switch (param.type) {
+    case "Identifier":
+      names.add((param as Identifier).name);
+      break;
+    case "ObjectPattern":
+      for (const prop of (param as any).properties) {
+        if (prop.type === "RestElement") {
+          collectParamNames(prop.argument, names);
+        } else {
+          collectParamNames(prop.value, names);
+        }
+      }
+      break;
+    case "ArrayPattern":
+      for (const el of (param as any).elements) {
+        if (el) collectParamNames(el, names);
+      }
+      break;
+    case "AssignmentPattern":
+      collectParamNames((param as any).left, names);
+      break;
+    case "RestElement":
+      collectParamNames((param as any).argument, names);
+      break;
+  }
+}
+
+function getTopLevelConstNames(ast: Program): string[] {
+  const names: string[] = [];
+  for (const stmt of ast.body) {
+    if (stmt.type === "VariableDeclaration" && stmt.kind === "const") {
+      for (const decl of stmt.declarations) {
+        if (decl.id.type === "Identifier") {
+          names.push(decl.id.name);
+        }
+      }
+    }
+  }
+  return names;
+}
+
+function getTopLevelFunctionNames(ast: Program): string[] {
+  const names: string[] = [];
+  for (const stmt of ast.body) {
+    if (stmt.type === "FunctionDeclaration" && stmt.id) {
+      names.push(stmt.id.name);
+    }
+  }
+  return names;
+}
+
+function findScopeParent(targetNode: AnyNode, rootNode: AnyNode): ArrowFunctionExpression | FunctionDeclaration | null {
+  let found: ArrowFunctionExpression | FunctionDeclaration | null = null;
 
   function walk(node: AnyNode): boolean {
     if (node === targetNode) {
       return true;
     }
 
-    const isArrow = node.type === "ArrowFunctionExpression";
+    const isScope = node.type === "ArrowFunctionExpression" || node.type === "FunctionDeclaration";
 
-    if (isArrow) {
-      found = node as ArrowFunctionExpression;
+    if (isScope) {
+      found = node as ArrowFunctionExpression | FunctionDeclaration;
     }
 
     for (const key of Object.keys(node)) {
@@ -101,7 +217,7 @@ function findArrowParent(targetNode: AnyNode, rootNode: AnyNode): ArrowFunctionE
       }
     }
 
-    if (isArrow) {
+    if (isScope) {
       found = null;
     }
 
@@ -111,3 +227,31 @@ function findArrowParent(targetNode: AnyNode, rootNode: AnyNode): ArrowFunctionE
   walk(rootNode);
   return found;
 }
+
+function buildParentMap(ast: Program): Map<any, any> {
+  const parentMap = new Map<any, any>();
+
+  function visit(node: any, parent: any): void {
+    if (!node || typeof node !== "object") return;
+    if (node.type) {
+      parentMap.set(node, parent);
+    }
+    for (const key of Object.keys(node)) {
+      const value = node[key];
+      if (value && typeof value === "object") {
+        if (Array.isArray(value)) {
+          for (const child of value) {
+            if (child && typeof child === "object" && child.type) {
+              visit(child, node);
+            }
+          }
+        } else if (value.type) {
+          visit(value, node);
+        }
+      }
+    }
+  }
+
+  visit(ast, null);
+  return parentMap;
+}

package/src/builtins.ts

@@ -49,6 +49,7 @@ export interface BuiltinSchema {
 const MATH = "Math";
 const NUMBER = "Number";
 const NUMBER_PROTOTYPE = "Number.prototype";
+const STRING = "String";
 const ARRAY = "Array";
 const ARRAY_PROTOTYPE = "Array.prototype";
 const STRING_PROTOTYPE = "String.prototype";
@@ -739,6 +740,11 @@ const BUILTINS: Record<string, BuiltinSchema> = {
     },
   },
 
+  [STRING]: {
+    global: true,
+    intrinsic: false,
+  },
+
   [STRING_PROTOTYPE]: {
     global: false,
     intrinsic: true,

package/src/codegen/generate-typescript-definitions.test.ts

@@ -265,8 +265,7 @@ describe("generateTypeScriptDefinitions", () => {
 
       const result = generateTypeScriptDefinitions(schema);
 
-      expect(result).toContain("const data:");
-      expect(result).toContain("userName: string");
+      expect(result).toContain("const userName: string");
     });
 
     it("should generate data with multiple property types", () => {
@@ -281,10 +280,9 @@ describe("generateTypeScriptDefinitions", () => {
 
       const result = generateTypeScriptDefinitions(schema);
 
-      expect(result).toContain("const data:");
-      expect(result).toContain("name: string");
-      expect(result).toContain("age: number");
-      expect(result).toContain("active: boolean");
+      expect(result).toContain("const name: string");
+      expect(result).toContain("const age: number");
+      expect(result).toContain("const active: boolean");
     });
 
     it("should generate data with object property", () => {
@@ -303,8 +301,7 @@ describe("generateTypeScriptDefinitions", () => {
 
       const result = generateTypeScriptDefinitions(schema);
 
-      expect(result).toContain("const data:");
-      expect(result).toContain("user:");
+      expect(result).toContain("const user:");
       expect(result).toContain("name: string");
       expect(result).toContain("email: string");
     });
@@ -331,8 +328,7 @@ describe("generateTypeScriptDefinitions", () => {
 
       const result = generateTypeScriptDefinitions(schema);
 
-      expect(result).toContain("const data:");
-      expect(result).toContain("user:");
+      expect(result).toContain("const user:");
       expect(result).toContain("profile:");
       expect(result).toContain("avatar: string");
       expect(result).toContain("bio: string");
@@ -355,9 +351,8 @@ describe("generateTypeScriptDefinitions", () => {
 
       const result = generateTypeScriptDefinitions(schema);
 
-      expect(result).toContain("const data:");
-      expect(result).toContain("tags: string[]");
-      expect(result).toContain("scores: number[]");
+      expect(result).toContain("const tags: string[]");
+      expect(result).toContain("const scores: number[]");
     });
 
     it("should generate data with array of objects", () => {
@@ -379,8 +374,7 @@ describe("generateTypeScriptDefinitions", () => {
 
       const result = generateTypeScriptDefinitions(schema);
 
-      expect(result).toContain("const data:");
-      expect(result).toContain("users:");
+      expect(result).toContain("const users:");
       expect(result).toContain("name: string");
       expect(result).toContain("age: number");
       expect(result).toContain("[]");
@@ -419,9 +413,10 @@ describe("generateTypeScriptDefinitions", () => {
 
       const result = generateTypeScriptDefinitions(schema);
 
-      expect(result).toContain("const data:");
-      expect(result).toContain('status: "pending" | "active" | "completed"');
-      expect(result).toContain("priority: 1 | 2 | 3");
+      expect(result).toContain("const status:");
+      expect(result).toContain('"pending" | "active" | "completed"');
+      expect(result).toContain("const priority:");
+      expect(result).toContain("1 | 2 | 3");
     });
   });
 
@@ -448,9 +443,8 @@ describe("generateTypeScriptDefinitions", () => {
 
       const result = generateTypeScriptDefinitions(schema);
 
-      expect(result).toContain("const data:");
-      expect(result).toContain("userName: string");
-      expect(result).toContain("count: number");
+      expect(result).toContain("const userName: string");
+      expect(result).toContain("const count: number");
 
       expect(result).toContain("interface DisplayProps");
       expect(result).toContain("interface CounterProps");
@@ -589,8 +583,7 @@ describe("generateTypeScriptDefinitions", () => {
       expect(result).toContain("declare global");
       expect(result).toContain("export {};");
 
-      expect(result).toContain("const data:");
-      expect(result).toContain("user:");
+      expect(result).toContain("const user:");
       expect(result).toContain("name: string");
       expect(result).toContain("email: string");
       expect(result).toContain("settings:");