nestjs-doctor 0.3.0 → 0.3.2

package/README.md

@@ -13,7 +13,7 @@
 </p>
 
 <p align="center">
-  47 built-in rules across <b>security</b>, <b>performance</b>, <b>correctness</b>, and <b>architecture</b>. Outputs a <b>0-100 score</b> with actionable diagnostics. Zero config. Monorepo support. Built to catch the anti-patterns that AI-generated code loves to introduce.
+  45 built-in rules across <b>security</b>, <b>performance</b>, <b>correctness</b>, and <b>architecture</b>. Outputs a <b>0-100 score</b> with actionable diagnostics. Zero config. Monorepo support. Built to catch the anti-patterns that AI-generated code loves to introduce.
 </p>
 
 ---
@@ -166,7 +166,7 @@ Or use a `"nestjs-doctor"` key in `package.json`.
 | Key | Type | Description |
 |-----|------|-------------|
 | `include` | `string[]` | Glob patterns to scan (default: `["**/*.ts"]`) |
-| `exclude` | `string[]` | Glob patterns to skip (default includes `node_modules`, `dist`, test files) |
+| `exclude` | `string[]` | Glob patterns to skip (default includes `node_modules`, `dist`, `build`, `coverage`, `*.spec.ts`, `*.test.ts`, `*.e2e-spec.ts`, `*.e2e-test.ts`, `*.d.ts`, `test/`, `tests/`, `__tests__/`, `__mocks__/`, `__fixtures__/`) |
 | `minScore` | `number` | Minimum passing score (0-100). Exits with code 1 if below threshold |
 | `ignore.rules` | `string[]` | Rule IDs to suppress |
 | `ignore.files` | `string[]` | Glob patterns for files whose diagnostics are hidden |
@@ -234,15 +234,13 @@ mono.combined;      // Merged DiagnoseResult
 
 ---
 
-## Rules (47)
+## Rules (45)
 
-### Security (11)
+### Security (9)
 
 | Rule | Severity | What it catches |
 |------|----------|-----------------|
 | `no-hardcoded-secrets` | error | API keys, tokens, passwords in source code |
-| `no-wildcard-cors` | error | CORS with `origin: '*'` or `origin: true` |
-| `no-unsafe-raw-query` | error | Template literal interpolation in raw SQL |
 | `no-eval` | error | `eval()` or `new Function()` usage |
 | `no-csrf-disabled` | error | Explicitly disabling CSRF protection |
 | `no-dangerous-redirects` | error | Redirects with user-controlled input |
@@ -257,7 +255,7 @@ mono.combined;      // Merged DiagnoseResult
 | Rule | Severity | What it catches |
 |------|----------|-----------------|
 | `no-missing-injectable` | error | Provider in module missing `@Injectable()` |
-| `no-duplicate-routes` | error | Same method + path twice in a controller |
+| `no-duplicate-routes` | error | Same method + path + version twice in a controller |
 | `no-missing-guard-method` | error | Guard class missing `canActivate()` |
 | `no-missing-pipe-method` | error | Pipe class missing `transform()` |
 | `no-missing-filter-catch` | error | `@Catch()` class missing `catch()` |

package/dist/api/index.cjs

@@ -467,6 +467,18 @@ const noGodService = {
 
 //#endregion
 //#region src/rules/architecture/no-manual-instantiation.ts
+const DI_ONLY_SUFFIXES = [
+	"Service",
+	"Repository",
+	"Gateway",
+	"Resolver"
+];
+const CONTEXT_AWARE_SUFFIXES = [
+	"Guard",
+	"Interceptor",
+	"Pipe",
+	"Filter"
+];
 const noManualInstantiation = {
 	meta: {
 		id: "architecture/no-manual-instantiation",
@@ -479,7 +491,16 @@ const noManualInstantiation = {
 		const newExpressions = context.sourceFile.getDescendantsOfKind(ts_morph.SyntaxKind.NewExpression);
 		for (const expr of newExpressions) {
 			const exprText = expr.getExpression().getText();
-			if (exprText.endsWith("Service") || exprText.endsWith("Repository") || exprText.endsWith("Guard") || exprText.endsWith("Interceptor") || exprText.endsWith("Pipe") || exprText.endsWith("Filter") || exprText.endsWith("Gateway") || exprText.endsWith("Resolver")) context.report({
+			const isDiOnly = DI_ONLY_SUFFIXES.some((s) => exprText.endsWith(s));
+			const isContextAware = CONTEXT_AWARE_SUFFIXES.some((s) => exprText.endsWith(s));
+			if (!(isDiOnly || isContextAware)) continue;
+			if (isContextAware) {
+				if (expr.getFirstAncestorByKind(ts_morph.SyntaxKind.Decorator)) continue;
+				const inMethod = expr.getFirstAncestorByKind(ts_morph.SyntaxKind.MethodDeclaration);
+				const inConstructor = expr.getFirstAncestorByKind(ts_morph.SyntaxKind.Constructor);
+				if (!(inMethod || inConstructor)) continue;
+			}
+			context.report({
 				filePath: context.filePath,
 				message: `Manual instantiation of '${exprText}' detected. Use dependency injection instead.`,
 				help: this.meta.help,
@@ -905,7 +926,7 @@ const noDuplicateRoutes = {
 		id: "correctness/no-duplicate-routes",
 		category: "correctness",
 		severity: "error",
-		description: "Same HTTP method + route path should not appear twice in a single controller",
+		description: "Same HTTP method + route path + version should not appear twice in a single controller",
 		help: "Remove or rename one of the duplicate route handlers."
 	},
 	check(context) {
@@ -917,7 +938,8 @@ const noDuplicateRoutes = {
 				if (!HTTP_METHOD_DECORATORS.has(decoratorName)) continue;
 				const args = decorator.getArguments();
 				const path = args.length > 0 ? args[0].getText() : "\"\"";
-				const routeKey = `${decoratorName}:${path}`;
+				const versionDecorator = method.getDecorator("Version");
+				const routeKey = `${decoratorName}:${path}:${versionDecorator ? versionDecorator.getArguments()[0]?.getText() ?? "" : ""}`;
 				const existing = routeMap.get(routeKey);
 				if (existing) context.report({
 					filePath: context.filePath,
@@ -984,6 +1006,7 @@ const noMissingFilterCatch = {
 	check(context) {
 		for (const cls of context.sourceFile.getClasses()) {
 			if (!hasDecorator(cls, "Catch")) continue;
+			if (cls.getExtends()) continue;
 			if (!cls.getMethods().some((m) => m.getName() === "catch")) context.report({
 				filePath: context.filePath,
 				message: `Exception filter '${cls.getName()}' has @Catch() but is missing the 'catch()' method.`,
@@ -1010,6 +1033,7 @@ const noMissingGuardMethod = {
 			const name = cls.getName() ?? "";
 			if (!name.endsWith("Guard")) continue;
 			if (!hasDecorator(cls, "Injectable")) continue;
+			if (cls.getExtends()) continue;
 			if (!cls.getMethods().some((m) => m.getName() === "canActivate")) context.report({
 				filePath: context.filePath,
 				message: `Guard '${name}' is missing the 'canActivate()' method.`,
@@ -1080,6 +1104,7 @@ const noMissingInterceptorMethod = {
 			const name = cls.getName() ?? "";
 			if (!name.endsWith("Interceptor")) continue;
 			if (!hasDecorator(cls, "Injectable")) continue;
+			if (cls.getExtends()) continue;
 			if (!cls.getMethods().some((m) => m.getName() === "intercept")) context.report({
 				filePath: context.filePath,
 				message: `Interceptor '${name}' is missing the 'intercept()' method.`,
@@ -1132,6 +1157,7 @@ const noMissingPipeMethod = {
 			const name = cls.getName() ?? "";
 			if (!name.endsWith("Pipe")) continue;
 			if (!hasDecorator(cls, "Injectable")) continue;
+			if (cls.getExtends()) continue;
 			if (!cls.getMethods().some((m) => m.getName() === "transform")) context.report({
 				filePath: context.filePath,
 				message: `Pipe '${name}' is missing the 'transform()' method.`,
@@ -1825,7 +1851,7 @@ const noExposedStackTrace = {
 //#region src/rules/security/no-hardcoded-secrets.ts
 const SECRET_PATTERNS = [
 	{
-		pattern: /^[A-Za-z0-9+/]{40,}={0,2}$/,
+		pattern: /^(?=.*\d)[A-Za-z0-9+/]{40,}={0,2}$/,
 		name: "Base64 key"
 	},
 	{
@@ -1880,8 +1906,15 @@ const PLACEHOLDER_VALUES = new Set([
 	"changeme",
 	"password"
 ]);
+const DOT_SEPARATED_CONSTANT = /^[A-Za-z][A-Za-z0-9_]*(\.[A-Za-z][A-Za-z0-9_]*)+$/;
 function isSuspiciousValue(value) {
-	return value.length >= 8 && !value.includes("${") && !value.startsWith("process.env") && !PLACEHOLDER_VALUES.has(value);
+	if (value.length < 8) return false;
+	if (value.includes("${")) return false;
+	if (value.startsWith("process.env")) return false;
+	if (PLACEHOLDER_VALUES.has(value)) return false;
+	if (value.includes(" ")) return false;
+	if (DOT_SEPARATED_CONSTANT.test(value)) return false;
+	return true;
 }
 function hasSuspiciousName(name) {
 	return VARIABLE_NAME_PATTERNS.some((p) => p.test(name));
@@ -1942,41 +1975,6 @@ const noHardcodedSecrets = {
 	}
 };
 
-//#endregion
-//#region src/rules/security/no-unsafe-raw-query.ts
-const RAW_QUERY_METHODS = new Set([
-	"$executeRaw",
-	"$queryRaw",
-	"$executeRawUnsafe",
-	"$queryRawUnsafe",
-	"query"
-]);
-const noUnsafeRawQuery = {
-	meta: {
-		id: "security/no-unsafe-raw-query",
-		category: "security",
-		severity: "error",
-		description: "Raw SQL queries with template literal interpolation are a SQL injection risk",
-		help: "Use parameterized queries or Prisma's tagged template (Prisma.sql`...`) instead of string interpolation."
-	},
-	check(context) {
-		const callExpressions = context.sourceFile.getDescendantsOfKind(ts_morph.SyntaxKind.CallExpression);
-		for (const call of callExpressions) {
-			const methodName = call.getExpression().getText().split(".").pop() ?? "";
-			if (!RAW_QUERY_METHODS.has(methodName)) continue;
-			const args = call.getArguments();
-			if (args.length === 0) continue;
-			if (args[0].getKind() === ts_morph.SyntaxKind.TemplateExpression) context.report({
-				filePath: context.filePath,
-				message: `Raw SQL query '${methodName}()' uses template literal interpolation — SQL injection risk.`,
-				help: this.meta.help,
-				line: call.getStartLineNumber(),
-				column: 1
-			});
-		}
-	}
-};
-
 //#endregion
 //#region src/rules/security/no-weak-crypto.ts
 const WEAK_ALGORITHMS = new Set(["md5", "sha1"]);
@@ -2008,34 +2006,6 @@ const noWeakCrypto = {
 	}
 };
 
-//#endregion
-//#region src/rules/security/no-wildcard-cors.ts
-const noWildcardCors = {
-	meta: {
-		id: "security/no-wildcard-cors",
-		category: "security",
-		severity: "error",
-		description: "CORS should not be configured with origin: '*' or origin: true — allows any domain",
-		help: "Specify allowed origins explicitly instead of using wildcard CORS."
-	},
-	check(context) {
-		const propertyAssignments = context.sourceFile.getDescendantsOfKind(ts_morph.SyntaxKind.PropertyAssignment);
-		for (const prop of propertyAssignments) {
-			if (prop.getName() !== "origin") continue;
-			const initializer = prop.getInitializer();
-			if (!initializer) continue;
-			const text = initializer.getText();
-			if (text === "'*'" || text === "\"*\"" || text === "true") context.report({
-				filePath: context.filePath,
-				message: `CORS configured with origin: ${text} — allows requests from any domain.`,
-				help: this.meta.help,
-				line: prop.getStartLineNumber(),
-				column: 1
-			});
-		}
-	}
-};
-
 //#endregion
 //#region src/rules/security/require-auth-guard.ts
 const requireAuthGuard = {
@@ -2122,8 +2092,6 @@ const allRules = [
 	requireInjectDecorator,
 	noMissingInjectable,
 	noHardcodedSecrets,
-	noWildcardCors,
-	noUnsafeRawQuery,
 	requireAuthGuard,
 	noEval,
 	noWeakCrypto,
@@ -2224,7 +2192,13 @@ const DEFAULT_CONFIG = {
 		"**/*.spec.ts",
 		"**/*.test.ts",
 		"**/*.e2e-spec.ts",
-		"**/*.d.ts"
+		"**/*.e2e-test.ts",
+		"**/*.d.ts",
+		"**/test/**",
+		"**/tests/**",
+		"**/__tests__/**",
+		"**/__mocks__/**",
+		"**/__fixtures__/**"
 	]
 };
 

package/dist/api/index.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/engine/module-graph.ts","../../src/engine/type-resolver.ts","../../src/types/diagnostic.ts","../../src/types/config.ts","../../src/rules/types.ts","../../src/rules/index.ts","../../src/types/errors.ts","../../src/types/result.ts","../../src/api/index.ts"],"mappings":";;;UASiB,UAAA;EAChB,gBAAA,EAAkB,gBAAA;EAClB,WAAA;EACA,OAAA;EACA,QAAA;EACA,OAAA;EACA,IAAA;EACA,SAAA;AAAA;AAAA,UAGgB,WAAA;EAChB,KAAA,EAAO,GAAA,SAAY,GAAA;EACnB,OAAA,EAAS,GAAA,SAAY,UAAA;EACrB,gBAAA,EAAkB,GAAA,SAAY,UAAA;AAAA;;;UCjBd,YAAA;EAChB,gBAAA,EAAkB,gBAAA;EAClB,YAAA;EACA,QAAA;EACA,IAAA;EACA,iBAAA;AAAA;;;KCVW,QAAA;AAAA,KACA,QAAA;AAAA,UAMK,UAAA;EAChB,QAAA,EAAU,QAAA;EACV,MAAA;EACA,QAAA;EACA,IAAA;EACA,IAAA;EACA,OAAA;EACA,IAAA;EACA,QAAA,EAAU,QAAA;AAAA;;;UCbM,YAAA;EAChB,OAAA;EACA,QAAA,GAAW,QAAA;AAAA;AAAA,UAGK,wBAAA;EAChB,KAAA;EACA,KAAA;AAAA;AAAA,UAGgB,kBAAA;EAChB,UAAA,GAAa,OAAA,CAAQ,MAAA,CAAO,QAAA;EAC5B,OAAA;EACA,MAAA,GAAS,wBAAA;EACT,OAAA;EACA,QAAA;EACA,KAAA,GAAQ,MAAA,SAAe,YAAA;EACvB,UAAA;IACC,kBAAA;IACA,gBAAA;IACA,iBAAA;IACA,cAAA;EAAA;AAAA;;;KCjBU,SAAA;AAAA,UAEK,QAAA;EAChB,QAAA,EAAU,QAAA;EACV,WAAA;EACA,IAAA;EACA,EAAA;EACA,KAAA,GAAQ,SAAA;EACR,QAAA,EAAU,QAAA;AAAA;AAAA,UAGM,WAAA;EAChB,QAAA;EACA,MAAA,CAAO,UAAA,EAAY,IAAA,CAAK,UAAA;EACxB,UAAA,EAAY,UAAA;AAAA;AAAA,UAGI,kBAAA;EAChB,MAAA,EAAQ,kBAAA;EACR,KAAA;EACA,WAAA,EAAa,WAAA;EACb,OAAA,EAAS,OAAA;EACT,SAAA,EAAW,GAAA,SAAY,YAAA;EACvB,MAAA,CAAO,UAAA,EAAY,IAAA,CAAK,UAAA;AAAA;AAAA,UAGR,IAAA;EAChB,KAAA,CAAM,OAAA,EAAS,WAAA;EACf,IAAA,EAAM,QAAA;AAAA;AAAA,UAGU,WAAA;EAChB,KAAA,CAAM,OAAA,EAAS,kBAAA;EACf,IAAA,EAAM,QAAA;AAAA;AAAA,KAGK,OAAA,GAAU,IAAA,GAAO,WAAA;;;iBCsEb,QAAA,CAAA,GAAY,OAAA;;;cChHf,iBAAA,SAA0B,KAAA;cAC1B,OAAA;AAAA;AAAA,cAMA,kBAAA,SAA2B,iBAAA;cAC3B,OAAA;AAAA;AAAA,cAMA,SAAA,SAAkB,iBAAA;cAClB,OAAA;AAAA;AAAA,cAMA,eAAA,SAAwB,iBAAA;cACxB,OAAA;AAAA;;;UCpBI,KAAA;EAChB,KAAA;EACA,KAAA;AAAA;AAAA,UAGgB,WAAA;EAChB,SAAA;EACA,SAAA;EACA,WAAA;EACA,IAAA;EACA,WAAA;EACA,GAAA;AAAA;AAAA,UAGgB,eAAA;EAChB,UAAA,EAAY,MAAA,CAAO,QAAA;EACnB,MAAA;EACA,IAAA;EACA,KAAA;EACA,QAAA;AAAA;AAAA,UAGgB,aAAA;EAChB,KAAA;EACA,MAAA;AAAA;AAAA,UAGgB,cAAA;EAChB,WAAA,EAAa,UAAA;EACb,SAAA;EACA,OAAA,EAAS,WAAA;EACT,UAAA,EAAY,aAAA;EACZ,KAAA,EAAO,KAAA;EACP,OAAA,EAAS,eAAA;AAAA;AAAA,UAGO,gBAAA;EAChB,IAAA;EACA,MAAA,EAAQ,cAAA;AAAA;AAAA,UAGQ,cAAA;EAChB,QAAA,EAAU,cAAA;EACV,SAAA;EACA,UAAA;EACA,WAAA,EAAa,gBAAA;AAAA;;;;;;;;;;;iBCiBQ,QAAA,CACrB,IAAA,UACA,OAAA;EAAW,MAAA;AAAA,IAAsB,OAAA,CAFJ,cAAA;AR7C9B;;;;;;;;;;;AAAA,iBQgEsB,gBAAA,CACrB,IAAA,UACA,OAAA;EAAW,MAAA;AAAA,IAAsB,OAAA,CAFI,cAAA"}
+{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/engine/module-graph.ts","../../src/engine/type-resolver.ts","../../src/types/diagnostic.ts","../../src/types/config.ts","../../src/rules/types.ts","../../src/rules/index.ts","../../src/types/errors.ts","../../src/types/result.ts","../../src/api/index.ts"],"mappings":";;;UASiB,UAAA;EAChB,gBAAA,EAAkB,gBAAA;EAClB,WAAA;EACA,OAAA;EACA,QAAA;EACA,OAAA;EACA,IAAA;EACA,SAAA;AAAA;AAAA,UAGgB,WAAA;EAChB,KAAA,EAAO,GAAA,SAAY,GAAA;EACnB,OAAA,EAAS,GAAA,SAAY,UAAA;EACrB,gBAAA,EAAkB,GAAA,SAAY,UAAA;AAAA;;;UCjBd,YAAA;EAChB,gBAAA,EAAkB,gBAAA;EAClB,YAAA;EACA,QAAA;EACA,IAAA;EACA,iBAAA;AAAA;;;KCVW,QAAA;AAAA,KACA,QAAA;AAAA,UAMK,UAAA;EAChB,QAAA,EAAU,QAAA;EACV,MAAA;EACA,QAAA;EACA,IAAA;EACA,IAAA;EACA,OAAA;EACA,IAAA;EACA,QAAA,EAAU,QAAA;AAAA;;;UCbM,YAAA;EAChB,OAAA;EACA,QAAA,GAAW,QAAA;AAAA;AAAA,UAGK,wBAAA;EAChB,KAAA;EACA,KAAA;AAAA;AAAA,UAGgB,kBAAA;EAChB,UAAA,GAAa,OAAA,CAAQ,MAAA,CAAO,QAAA;EAC5B,OAAA;EACA,MAAA,GAAS,wBAAA;EACT,OAAA;EACA,QAAA;EACA,KAAA,GAAQ,MAAA,SAAe,YAAA;EACvB,UAAA;IACC,kBAAA;IACA,gBAAA;IACA,iBAAA;IACA,cAAA;EAAA;AAAA;;;KCjBU,SAAA;AAAA,UAEK,QAAA;EAChB,QAAA,EAAU,QAAA;EACV,WAAA;EACA,IAAA;EACA,EAAA;EACA,KAAA,GAAQ,SAAA;EACR,QAAA,EAAU,QAAA;AAAA;AAAA,UAGM,WAAA;EAChB,QAAA;EACA,MAAA,CAAO,UAAA,EAAY,IAAA,CAAK,UAAA;EACxB,UAAA,EAAY,UAAA;AAAA;AAAA,UAGI,kBAAA;EAChB,MAAA,EAAQ,kBAAA;EACR,KAAA;EACA,WAAA,EAAa,WAAA;EACb,OAAA,EAAS,OAAA;EACT,SAAA,EAAW,GAAA,SAAY,YAAA;EACvB,MAAA,CAAO,UAAA,EAAY,IAAA,CAAK,UAAA;AAAA;AAAA,UAGR,IAAA;EAChB,KAAA,CAAM,OAAA,EAAS,WAAA;EACf,IAAA,EAAM,QAAA;AAAA;AAAA,UAGU,WAAA;EAChB,KAAA,CAAM,OAAA,EAAS,kBAAA;EACf,IAAA,EAAM,QAAA;AAAA;AAAA,KAGK,OAAA,GAAU,IAAA,GAAO,WAAA;;;iBCkEb,QAAA,CAAA,GAAY,OAAA;;;cC5Gf,iBAAA,SAA0B,KAAA;cAC1B,OAAA;AAAA;AAAA,cAMA,kBAAA,SAA2B,iBAAA;cAC3B,OAAA;AAAA;AAAA,cAMA,SAAA,SAAkB,iBAAA;cAClB,OAAA;AAAA;AAAA,cAMA,eAAA,SAAwB,iBAAA;cACxB,OAAA;AAAA;;;UCpBI,KAAA;EAChB,KAAA;EACA,KAAA;AAAA;AAAA,UAGgB,WAAA;EAChB,SAAA;EACA,SAAA;EACA,WAAA;EACA,IAAA;EACA,WAAA;EACA,GAAA;AAAA;AAAA,UAGgB,eAAA;EAChB,UAAA,EAAY,MAAA,CAAO,QAAA;EACnB,MAAA;EACA,IAAA;EACA,KAAA;EACA,QAAA;AAAA;AAAA,UAGgB,aAAA;EAChB,KAAA;EACA,MAAA;AAAA;AAAA,UAGgB,cAAA;EAChB,WAAA,EAAa,UAAA;EACb,SAAA;EACA,OAAA,EAAS,WAAA;EACT,UAAA,EAAY,aAAA;EACZ,KAAA,EAAO,KAAA;EACP,OAAA,EAAS,eAAA;AAAA;AAAA,UAGO,gBAAA;EAChB,IAAA;EACA,MAAA,EAAQ,cAAA;AAAA;AAAA,UAGQ,cAAA;EAChB,QAAA,EAAU,cAAA;EACV,SAAA;EACA,UAAA;EACA,WAAA,EAAa,gBAAA;AAAA;;;;;;;;;;;iBCiBQ,QAAA,CACrB,IAAA,UACA,OAAA;EAAW,MAAA;AAAA,IAAsB,OAAA,CAFJ,cAAA;AR7C9B;;;;;;;;;;;AAAA,iBQgEsB,gBAAA,CACrB,IAAA,UACA,OAAA;EAAW,MAAA;AAAA,IAAsB,OAAA,CAFI,cAAA"}

package/dist/api/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/engine/module-graph.ts","../../src/engine/type-resolver.ts","../../src/types/diagnostic.ts","../../src/types/config.ts","../../src/rules/types.ts","../../src/rules/index.ts","../../src/types/errors.ts","../../src/types/result.ts","../../src/api/index.ts"],"mappings":";;;UASiB,UAAA;EAChB,gBAAA,EAAkB,gBAAA;EAClB,WAAA;EACA,OAAA;EACA,QAAA;EACA,OAAA;EACA,IAAA;EACA,SAAA;AAAA;AAAA,UAGgB,WAAA;EAChB,KAAA,EAAO,GAAA,SAAY,GAAA;EACnB,OAAA,EAAS,GAAA,SAAY,UAAA;EACrB,gBAAA,EAAkB,GAAA,SAAY,UAAA;AAAA;;;UCjBd,YAAA;EAChB,gBAAA,EAAkB,gBAAA;EAClB,YAAA;EACA,QAAA;EACA,IAAA;EACA,iBAAA;AAAA;;;KCVW,QAAA;AAAA,KACA,QAAA;AAAA,UAMK,UAAA;EAChB,QAAA,EAAU,QAAA;EACV,MAAA;EACA,QAAA;EACA,IAAA;EACA,IAAA;EACA,OAAA;EACA,IAAA;EACA,QAAA,EAAU,QAAA;AAAA;;;UCbM,YAAA;EAChB,OAAA;EACA,QAAA,GAAW,QAAA;AAAA;AAAA,UAGK,wBAAA;EAChB,KAAA;EACA,KAAA;AAAA;AAAA,UAGgB,kBAAA;EAChB,UAAA,GAAa,OAAA,CAAQ,MAAA,CAAO,QAAA;EAC5B,OAAA;EACA,MAAA,GAAS,wBAAA;EACT,OAAA;EACA,QAAA;EACA,KAAA,GAAQ,MAAA,SAAe,YAAA;EACvB,UAAA;IACC,kBAAA;IACA,gBAAA;IACA,iBAAA;IACA,cAAA;EAAA;AAAA;;;KCjBU,SAAA;AAAA,UAEK,QAAA;EAChB,QAAA,EAAU,QAAA;EACV,WAAA;EACA,IAAA;EACA,EAAA;EACA,KAAA,GAAQ,SAAA;EACR,QAAA,EAAU,QAAA;AAAA;AAAA,UAGM,WAAA;EAChB,QAAA;EACA,MAAA,CAAO,UAAA,EAAY,IAAA,CAAK,UAAA;EACxB,UAAA,EAAY,UAAA;AAAA;AAAA,UAGI,kBAAA;EAChB,MAAA,EAAQ,kBAAA;EACR,KAAA;EACA,WAAA,EAAa,WAAA;EACb,OAAA,EAAS,OAAA;EACT,SAAA,EAAW,GAAA,SAAY,YAAA;EACvB,MAAA,CAAO,UAAA,EAAY,IAAA,CAAK,UAAA;AAAA;AAAA,UAGR,IAAA;EAChB,KAAA,CAAM,OAAA,EAAS,WAAA;EACf,IAAA,EAAM,QAAA;AAAA;AAAA,UAGU,WAAA;EAChB,KAAA,CAAM,OAAA,EAAS,kBAAA;EACf,IAAA,EAAM,QAAA;AAAA;AAAA,KAGK,OAAA,GAAU,IAAA,GAAO,WAAA;;;iBCsEb,QAAA,CAAA,GAAY,OAAA;;;cChHf,iBAAA,SAA0B,KAAA;cAC1B,OAAA;AAAA;AAAA,cAMA,kBAAA,SAA2B,iBAAA;cAC3B,OAAA;AAAA;AAAA,cAMA,SAAA,SAAkB,iBAAA;cAClB,OAAA;AAAA;AAAA,cAMA,eAAA,SAAwB,iBAAA;cACxB,OAAA;AAAA;;;UCpBI,KAAA;EAChB,KAAA;EACA,KAAA;AAAA;AAAA,UAGgB,WAAA;EAChB,SAAA;EACA,SAAA;EACA,WAAA;EACA,IAAA;EACA,WAAA;EACA,GAAA;AAAA;AAAA,UAGgB,eAAA;EAChB,UAAA,EAAY,MAAA,CAAO,QAAA;EACnB,MAAA;EACA,IAAA;EACA,KAAA;EACA,QAAA;AAAA;AAAA,UAGgB,aAAA;EAChB,KAAA;EACA,MAAA;AAAA;AAAA,UAGgB,cAAA;EAChB,WAAA,EAAa,UAAA;EACb,SAAA;EACA,OAAA,EAAS,WAAA;EACT,UAAA,EAAY,aAAA;EACZ,KAAA,EAAO,KAAA;EACP,OAAA,EAAS,eAAA;AAAA;AAAA,UAGO,gBAAA;EAChB,IAAA;EACA,MAAA,EAAQ,cAAA;AAAA;AAAA,UAGQ,cAAA;EAChB,QAAA,EAAU,cAAA;EACV,SAAA;EACA,UAAA;EACA,WAAA,EAAa,gBAAA;AAAA;;;;;;;;;;;iBCiBQ,QAAA,CACrB,IAAA,UACA,OAAA;EAAW,MAAA;AAAA,IAAsB,OAAA,CAFJ,cAAA;AR7C9B;;;;;;;;;;;AAAA,iBQgEsB,gBAAA,CACrB,IAAA,UACA,OAAA;EAAW,MAAA;AAAA,IAAsB,OAAA,CAFI,cAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/engine/module-graph.ts","../../src/engine/type-resolver.ts","../../src/types/diagnostic.ts","../../src/types/config.ts","../../src/rules/types.ts","../../src/rules/index.ts","../../src/types/errors.ts","../../src/types/result.ts","../../src/api/index.ts"],"mappings":";;;UASiB,UAAA;EAChB,gBAAA,EAAkB,gBAAA;EAClB,WAAA;EACA,OAAA;EACA,QAAA;EACA,OAAA;EACA,IAAA;EACA,SAAA;AAAA;AAAA,UAGgB,WAAA;EAChB,KAAA,EAAO,GAAA,SAAY,GAAA;EACnB,OAAA,EAAS,GAAA,SAAY,UAAA;EACrB,gBAAA,EAAkB,GAAA,SAAY,UAAA;AAAA;;;UCjBd,YAAA;EAChB,gBAAA,EAAkB,gBAAA;EAClB,YAAA;EACA,QAAA;EACA,IAAA;EACA,iBAAA;AAAA;;;KCVW,QAAA;AAAA,KACA,QAAA;AAAA,UAMK,UAAA;EAChB,QAAA,EAAU,QAAA;EACV,MAAA;EACA,QAAA;EACA,IAAA;EACA,IAAA;EACA,OAAA;EACA,IAAA;EACA,QAAA,EAAU,QAAA;AAAA;;;UCbM,YAAA;EAChB,OAAA;EACA,QAAA,GAAW,QAAA;AAAA;AAAA,UAGK,wBAAA;EAChB,KAAA;EACA,KAAA;AAAA;AAAA,UAGgB,kBAAA;EAChB,UAAA,GAAa,OAAA,CAAQ,MAAA,CAAO,QAAA;EAC5B,OAAA;EACA,MAAA,GAAS,wBAAA;EACT,OAAA;EACA,QAAA;EACA,KAAA,GAAQ,MAAA,SAAe,YAAA;EACvB,UAAA;IACC,kBAAA;IACA,gBAAA;IACA,iBAAA;IACA,cAAA;EAAA;AAAA;;;KCjBU,SAAA;AAAA,UAEK,QAAA;EAChB,QAAA,EAAU,QAAA;EACV,WAAA;EACA,IAAA;EACA,EAAA;EACA,KAAA,GAAQ,SAAA;EACR,QAAA,EAAU,QAAA;AAAA;AAAA,UAGM,WAAA;EAChB,QAAA;EACA,MAAA,CAAO,UAAA,EAAY,IAAA,CAAK,UAAA;EACxB,UAAA,EAAY,UAAA;AAAA;AAAA,UAGI,kBAAA;EAChB,MAAA,EAAQ,kBAAA;EACR,KAAA;EACA,WAAA,EAAa,WAAA;EACb,OAAA,EAAS,OAAA;EACT,SAAA,EAAW,GAAA,SAAY,YAAA;EACvB,MAAA,CAAO,UAAA,EAAY,IAAA,CAAK,UAAA;AAAA;AAAA,UAGR,IAAA;EAChB,KAAA,CAAM,OAAA,EAAS,WAAA;EACf,IAAA,EAAM,QAAA;AAAA;AAAA,UAGU,WAAA;EAChB,KAAA,CAAM,OAAA,EAAS,kBAAA;EACf,IAAA,EAAM,QAAA;AAAA;AAAA,KAGK,OAAA,GAAU,IAAA,GAAO,WAAA;;;iBCkEb,QAAA,CAAA,GAAY,OAAA;;;cC5Gf,iBAAA,SAA0B,KAAA;cAC1B,OAAA;AAAA;AAAA,cAMA,kBAAA,SAA2B,iBAAA;cAC3B,OAAA;AAAA;AAAA,cAMA,SAAA,SAAkB,iBAAA;cAClB,OAAA;AAAA;AAAA,cAMA,eAAA,SAAwB,iBAAA;cACxB,OAAA;AAAA;;;UCpBI,KAAA;EAChB,KAAA;EACA,KAAA;AAAA;AAAA,UAGgB,WAAA;EAChB,SAAA;EACA,SAAA;EACA,WAAA;EACA,IAAA;EACA,WAAA;EACA,GAAA;AAAA;AAAA,UAGgB,eAAA;EAChB,UAAA,EAAY,MAAA,CAAO,QAAA;EACnB,MAAA;EACA,IAAA;EACA,KAAA;EACA,QAAA;AAAA;AAAA,UAGgB,aAAA;EAChB,KAAA;EACA,MAAA;AAAA;AAAA,UAGgB,cAAA;EAChB,WAAA,EAAa,UAAA;EACb,SAAA;EACA,OAAA,EAAS,WAAA;EACT,UAAA,EAAY,aAAA;EACZ,KAAA,EAAO,KAAA;EACP,OAAA,EAAS,eAAA;AAAA;AAAA,UAGO,gBAAA;EAChB,IAAA;EACA,MAAA,EAAQ,cAAA;AAAA;AAAA,UAGQ,cAAA;EAChB,QAAA,EAAU,cAAA;EACV,SAAA;EACA,UAAA;EACA,WAAA,EAAa,gBAAA;AAAA;;;;;;;;;;;iBCiBQ,QAAA,CACrB,IAAA,UACA,OAAA;EAAW,MAAA;AAAA,IAAsB,OAAA,CAFJ,cAAA;AR7C9B;;;;;;;;;;;AAAA,iBQgEsB,gBAAA,CACrB,IAAA,UACA,OAAA;EAAW,MAAA;AAAA,IAAsB,OAAA,CAFI,cAAA"}

package/dist/api/index.mjs

@@ -438,6 +438,18 @@ const noGodService = {
 
 //#endregion
 //#region src/rules/architecture/no-manual-instantiation.ts
+const DI_ONLY_SUFFIXES = [
+	"Service",
+	"Repository",
+	"Gateway",
+	"Resolver"
+];
+const CONTEXT_AWARE_SUFFIXES = [
+	"Guard",
+	"Interceptor",
+	"Pipe",
+	"Filter"
+];
 const noManualInstantiation = {
 	meta: {
 		id: "architecture/no-manual-instantiation",
@@ -450,7 +462,16 @@ const noManualInstantiation = {
 		const newExpressions = context.sourceFile.getDescendantsOfKind(SyntaxKind.NewExpression);
 		for (const expr of newExpressions) {
 			const exprText = expr.getExpression().getText();
-			if (exprText.endsWith("Service") || exprText.endsWith("Repository") || exprText.endsWith("Guard") || exprText.endsWith("Interceptor") || exprText.endsWith("Pipe") || exprText.endsWith("Filter") || exprText.endsWith("Gateway") || exprText.endsWith("Resolver")) context.report({
+			const isDiOnly = DI_ONLY_SUFFIXES.some((s) => exprText.endsWith(s));
+			const isContextAware = CONTEXT_AWARE_SUFFIXES.some((s) => exprText.endsWith(s));
+			if (!(isDiOnly || isContextAware)) continue;
+			if (isContextAware) {
+				if (expr.getFirstAncestorByKind(SyntaxKind.Decorator)) continue;
+				const inMethod = expr.getFirstAncestorByKind(SyntaxKind.MethodDeclaration);
+				const inConstructor = expr.getFirstAncestorByKind(SyntaxKind.Constructor);
+				if (!(inMethod || inConstructor)) continue;
+			}
+			context.report({
 				filePath: context.filePath,
 				message: `Manual instantiation of '${exprText}' detected. Use dependency injection instead.`,
 				help: this.meta.help,
@@ -876,7 +897,7 @@ const noDuplicateRoutes = {
 		id: "correctness/no-duplicate-routes",
 		category: "correctness",
 		severity: "error",
-		description: "Same HTTP method + route path should not appear twice in a single controller",
+		description: "Same HTTP method + route path + version should not appear twice in a single controller",
 		help: "Remove or rename one of the duplicate route handlers."
 	},
 	check(context) {
@@ -888,7 +909,8 @@ const noDuplicateRoutes = {
 				if (!HTTP_METHOD_DECORATORS.has(decoratorName)) continue;
 				const args = decorator.getArguments();
 				const path = args.length > 0 ? args[0].getText() : "\"\"";
-				const routeKey = `${decoratorName}:${path}`;
+				const versionDecorator = method.getDecorator("Version");
+				const routeKey = `${decoratorName}:${path}:${versionDecorator ? versionDecorator.getArguments()[0]?.getText() ?? "" : ""}`;
 				const existing = routeMap.get(routeKey);
 				if (existing) context.report({
 					filePath: context.filePath,
@@ -955,6 +977,7 @@ const noMissingFilterCatch = {
 	check(context) {
 		for (const cls of context.sourceFile.getClasses()) {
 			if (!hasDecorator(cls, "Catch")) continue;
+			if (cls.getExtends()) continue;
 			if (!cls.getMethods().some((m) => m.getName() === "catch")) context.report({
 				filePath: context.filePath,
 				message: `Exception filter '${cls.getName()}' has @Catch() but is missing the 'catch()' method.`,
@@ -981,6 +1004,7 @@ const noMissingGuardMethod = {
 			const name = cls.getName() ?? "";
 			if (!name.endsWith("Guard")) continue;
 			if (!hasDecorator(cls, "Injectable")) continue;
+			if (cls.getExtends()) continue;
 			if (!cls.getMethods().some((m) => m.getName() === "canActivate")) context.report({
 				filePath: context.filePath,
 				message: `Guard '${name}' is missing the 'canActivate()' method.`,
@@ -1051,6 +1075,7 @@ const noMissingInterceptorMethod = {
 			const name = cls.getName() ?? "";
 			if (!name.endsWith("Interceptor")) continue;
 			if (!hasDecorator(cls, "Injectable")) continue;
+			if (cls.getExtends()) continue;
 			if (!cls.getMethods().some((m) => m.getName() === "intercept")) context.report({
 				filePath: context.filePath,
 				message: `Interceptor '${name}' is missing the 'intercept()' method.`,
@@ -1103,6 +1128,7 @@ const noMissingPipeMethod = {
 			const name = cls.getName() ?? "";
 			if (!name.endsWith("Pipe")) continue;
 			if (!hasDecorator(cls, "Injectable")) continue;
+			if (cls.getExtends()) continue;
 			if (!cls.getMethods().some((m) => m.getName() === "transform")) context.report({
 				filePath: context.filePath,
 				message: `Pipe '${name}' is missing the 'transform()' method.`,
@@ -1796,7 +1822,7 @@ const noExposedStackTrace = {
 //#region src/rules/security/no-hardcoded-secrets.ts
 const SECRET_PATTERNS = [
 	{
-		pattern: /^[A-Za-z0-9+/]{40,}={0,2}$/,
+		pattern: /^(?=.*\d)[A-Za-z0-9+/]{40,}={0,2}$/,
 		name: "Base64 key"
 	},
 	{
@@ -1851,8 +1877,15 @@ const PLACEHOLDER_VALUES = new Set([
 	"changeme",
 	"password"
 ]);
+const DOT_SEPARATED_CONSTANT = /^[A-Za-z][A-Za-z0-9_]*(\.[A-Za-z][A-Za-z0-9_]*)+$/;
 function isSuspiciousValue(value) {
-	return value.length >= 8 && !value.includes("${") && !value.startsWith("process.env") && !PLACEHOLDER_VALUES.has(value);
+	if (value.length < 8) return false;
+	if (value.includes("${")) return false;
+	if (value.startsWith("process.env")) return false;
+	if (PLACEHOLDER_VALUES.has(value)) return false;
+	if (value.includes(" ")) return false;
+	if (DOT_SEPARATED_CONSTANT.test(value)) return false;
+	return true;
 }
 function hasSuspiciousName(name) {
 	return VARIABLE_NAME_PATTERNS.some((p) => p.test(name));
@@ -1913,41 +1946,6 @@ const noHardcodedSecrets = {
 	}
 };
 
-//#endregion
-//#region src/rules/security/no-unsafe-raw-query.ts
-const RAW_QUERY_METHODS = new Set([
-	"$executeRaw",
-	"$queryRaw",
-	"$executeRawUnsafe",
-	"$queryRawUnsafe",
-	"query"
-]);
-const noUnsafeRawQuery = {
-	meta: {
-		id: "security/no-unsafe-raw-query",
-		category: "security",
-		severity: "error",
-		description: "Raw SQL queries with template literal interpolation are a SQL injection risk",
-		help: "Use parameterized queries or Prisma's tagged template (Prisma.sql`...`) instead of string interpolation."
-	},
-	check(context) {
-		const callExpressions = context.sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression);
-		for (const call of callExpressions) {
-			const methodName = call.getExpression().getText().split(".").pop() ?? "";
-			if (!RAW_QUERY_METHODS.has(methodName)) continue;
-			const args = call.getArguments();
-			if (args.length === 0) continue;
-			if (args[0].getKind() === SyntaxKind.TemplateExpression) context.report({
-				filePath: context.filePath,
-				message: `Raw SQL query '${methodName}()' uses template literal interpolation — SQL injection risk.`,
-				help: this.meta.help,
-				line: call.getStartLineNumber(),
-				column: 1
-			});
-		}
-	}
-};
-
 //#endregion
 //#region src/rules/security/no-weak-crypto.ts
 const WEAK_ALGORITHMS = new Set(["md5", "sha1"]);
@@ -1979,34 +1977,6 @@ const noWeakCrypto = {
 	}
 };
 
-//#endregion
-//#region src/rules/security/no-wildcard-cors.ts
-const noWildcardCors = {
-	meta: {
-		id: "security/no-wildcard-cors",
-		category: "security",
-		severity: "error",
-		description: "CORS should not be configured with origin: '*' or origin: true — allows any domain",
-		help: "Specify allowed origins explicitly instead of using wildcard CORS."
-	},
-	check(context) {
-		const propertyAssignments = context.sourceFile.getDescendantsOfKind(SyntaxKind.PropertyAssignment);
-		for (const prop of propertyAssignments) {
-			if (prop.getName() !== "origin") continue;
-			const initializer = prop.getInitializer();
-			if (!initializer) continue;
-			const text = initializer.getText();
-			if (text === "'*'" || text === "\"*\"" || text === "true") context.report({
-				filePath: context.filePath,
-				message: `CORS configured with origin: ${text} — allows requests from any domain.`,
-				help: this.meta.help,
-				line: prop.getStartLineNumber(),
-				column: 1
-			});
-		}
-	}
-};
-
 //#endregion
 //#region src/rules/security/require-auth-guard.ts
 const requireAuthGuard = {
@@ -2093,8 +2063,6 @@ const allRules = [
 	requireInjectDecorator,
 	noMissingInjectable,
 	noHardcodedSecrets,
-	noWildcardCors,
-	noUnsafeRawQuery,
 	requireAuthGuard,
 	noEval,
 	noWeakCrypto,
@@ -2195,7 +2163,13 @@ const DEFAULT_CONFIG = {
 		"**/*.spec.ts",
 		"**/*.test.ts",
 		"**/*.e2e-spec.ts",
-		"**/*.d.ts"
+		"**/*.e2e-test.ts",
+		"**/*.d.ts",
+		"**/test/**",
+		"**/tests/**",
+		"**/__tests__/**",
+		"**/__mocks__/**",
+		"**/__fixtures__/**"
 	]
 };