oxlint-plugin-react-doctor 0.7.9-dev.621be9b → 0.7.9-dev.6c5c91b

package/dist/index.js

@@ -27251,7 +27251,11 @@ const mouseEventsHaveKeyEvents = defineRule({
 //#region src/plugin/utils/has-directive.ts
 const hasDirective = (programNode, directive) => {
 	if (!isNodeOfType(programNode, "Program")) return false;
-	return Boolean(programNode.body?.some((statement) => isNodeOfType(statement, "ExpressionStatement") && isNodeOfType(statement.expression, "Literal") && statement.expression.value === directive));
+	for (const statement of programNode.body) {
+		if (!isNodeOfType(statement, "ExpressionStatement") || statement.directive === void 0) return false;
+		if (statement.directive === directive) return true;
+	}
+	return false;
 };
 //#endregion
 //#region src/plugin/rules/nextjs/nextjs-async-client-component.ts
@@ -46866,7 +46870,7 @@ const doConditionsImplyFormula = (conditions, target) => {
 	}
 	return facts.didConflict || evaluateBooleanFormula$1(target, facts.assignments) === true;
 };
-const getFunctionBindingSymbol = (functionNode, scopes) => {
+const getFunctionBindingSymbol$1 = (functionNode, scopes) => {
 	if (isNodeOfType(functionNode, "FunctionDeclaration") && functionNode.id) return scopes.symbolFor(functionNode.id);
 	const parent = functionNode.parent;
 	if ((isNodeOfType(functionNode, "ArrowFunctionExpression") || isNodeOfType(functionNode, "FunctionExpression")) && isNodeOfType(parent, "VariableDeclarator") && parent.init === functionNode && isNodeOfType(parent.id, "Identifier")) return scopes.symbolFor(parent.id);
@@ -46899,7 +46903,7 @@ const isNodeEvaluatedDuringRender = (node, componentNode, scopes, visitedFunctio
 	const synchronousCallbackCall = getSynchronousCallbackCall(functionNode);
 	if (synchronousCallbackCall) return isNodeEvaluatedDuringRender(synchronousCallbackCall, componentNode, scopes, visitedFunctionSymbolIds);
 	if (executesDuringRender(functionNode, scopes)) return isNodeEvaluatedDuringRender(functionNode.parent ?? functionNode, componentNode, scopes, visitedFunctionSymbolIds);
-	const functionSymbol = getFunctionBindingSymbol(functionNode, scopes);
+	const functionSymbol = getFunctionBindingSymbol$1(functionNode, scopes);
 	if (!functionSymbol || visitedFunctionSymbolIds.has(functionSymbol.id)) return false;
 	visitedFunctionSymbolIds.add(functionSymbol.id);
 	let callCount = 0;
@@ -46948,7 +46952,7 @@ const collectExposureConditions = (analysis, context, node, componentNode, prote
 				parent = synchronousCallbackCall.parent;
 				continue;
 			}
-			const functionSymbol = getFunctionBindingSymbol(parent, context.scopes);
+			const functionSymbol = getFunctionBindingSymbol$1(parent, context.scopes);
 			if (functionSymbol?.references.length === 1) {
 				const callExpression = isReferenceDirectlyCalled(functionSymbol.references[0].identifier);
 				if (callExpression) {
@@ -47158,7 +47162,7 @@ const getSetterExposureConditions = (analysis, context, setterReference, compone
 	const functionNode = findEnclosingFunction$1(setterReference.identifier);
 	if (!functionNode) return null;
 	if (isInlineJsxCallback(functionNode)) return [collectExposureConditions(analysis, context, functionNode, componentNode, protectedSymbolIds)];
-	const functionSymbol = getFunctionBindingSymbol(functionNode, context.scopes);
+	const functionSymbol = getFunctionBindingSymbol$1(functionNode, context.scopes);
 	if (!functionSymbol || functionSymbol.references.length === 0) return null;
 	const conditionsByReference = [];
 	for (const reference of functionSymbol.references) {
@@ -47546,7 +47550,7 @@ const isSelfReferentialSentinelValue = (variableName, literalValue) => literalVa
 const isIdentifierLikeKeyNameValue = (literalValue) => {
 	const wordSegments = literalValue.replace(/^[_$\s]+|[_$\s]+$/g, "").split(/[_\-:./$]+/).filter((segment) => segment.length > 0);
 	if (wordSegments.length < 2) return false;
-	return wordSegments.every((segment) => /^[a-z]+$/.test(segment));
+	return wordSegments.every((segment) => /^[a-z]+(?:[A-Z][a-z]+)*$/.test(segment));
 };
 const FRAMEWORK_ENV_ADVICE = [
 	[
@@ -47620,7 +47624,7 @@ const noSecretsInClientCode = defineRule({
 				const isServerOnlyScope = isInsideServerOnlyScope(node);
 				const trailingSuffix = getIdentifierTrailingWord(variableName);
 				const isUiConstant = SECRET_FALSE_POSITIVE_SUFFIXES.has(trailingSuffix);
-				if (shouldUseVariableNameHeuristic && !isServerOnlyScope && SECRET_VARIABLE_PATTERN.test(variableName) && !isUiConstant && !isPublicUrlValue(literalValue) && !isPlaceholderValueForVariableHeuristic && !isSelfReferentialSentinelValue(variableName, literalValue) && !isIdentifierLikeKeyNameValue(literalValue) && !isSelfReferentialSentinelValue(variableName, literalValue) && !isIdentifierLikeKeyNameValue(literalValue) && literalValue.length > 24) {
+				if (shouldUseVariableNameHeuristic && !isServerOnlyScope && SECRET_VARIABLE_PATTERN.test(variableName) && !isUiConstant && !isPublicUrlValue(literalValue) && !isPlaceholderValueForVariableHeuristic && !isSelfReferentialSentinelValue(variableName, literalValue) && !isIdentifierLikeKeyNameValue(literalValue) && literalValue.length > 24) {
 					context.report({
 						node,
 						message: `Hardcoding "${variableName}" in client code is a security vulnerability: the secret ships to the browser where anyone can read it.`
@@ -64945,6 +64949,109 @@ const isDeferrableSideEffectCall = (objectName, methodName) => {
 	if (ANALYTICS_DEFERRABLE_OBJECTS.has(objectName)) return ANALYTICS_DEFERRABLE_METHODS.has(methodName);
 	return false;
 };
+const NEXT_SERVER_SOURCE = "next/server";
+const NEXT_AFTER_EXPORT_NAMES = new Set(["after", "unstable_after"]);
+const isNextAfterImportSymbol = (symbol, contextNode) => {
+	if (symbol.kind !== "import") return false;
+	const importBinding = getImportBindingForName(contextNode, symbol.name);
+	return Boolean(importBinding && importBinding.source === NEXT_SERVER_SOURCE && !importBinding.isNamespace && importBinding.exportedName && NEXT_AFTER_EXPORT_NAMES.has(importBinding.exportedName));
+};
+const isDirectObjectPatternBinding = (symbol) => {
+	if (!isNodeOfType(symbol.declarationNode, "VariableDeclarator")) return false;
+	if (!isNodeOfType(symbol.declarationNode.id, "ObjectPattern")) return false;
+	let bindingNode = symbol.bindingIdentifier;
+	if (isNodeOfType(bindingNode.parent, "AssignmentPattern") && bindingNode.parent.left === bindingNode) bindingNode = bindingNode.parent;
+	const property = bindingNode.parent;
+	return Boolean(isNodeOfType(property, "Property") && property.value === bindingNode && property.parent === symbol.declarationNode.id);
+};
+const isNextServerNamespace = (expression, contextNode, scopes) => {
+	let candidate = stripParenExpression(expression);
+	const visitedSymbolIds = /* @__PURE__ */ new Set();
+	while (isNodeOfType(candidate, "Identifier")) {
+		const symbol = scopes.symbolFor(candidate);
+		if (!symbol || visitedSymbolIds.has(symbol.id)) return false;
+		if (symbol.kind === "import") {
+			const importBinding = getImportBindingForName(contextNode, symbol.name);
+			return Boolean(importBinding?.source === NEXT_SERVER_SOURCE && importBinding.isNamespace);
+		}
+		if (symbol.kind !== "const" || !symbol.initializer || !isNodeOfType(symbol.declarationNode, "VariableDeclarator") || symbol.declarationNode.id !== symbol.bindingIdentifier) return false;
+		visitedSymbolIds.add(symbol.id);
+		candidate = stripParenExpression(symbol.initializer);
+	}
+	return false;
+};
+const isNextAfterCallee = (callee, contextNode, scopes, visitedSymbolIds = /* @__PURE__ */ new Set()) => {
+	const candidate = stripParenExpression(callee);
+	if (isNodeOfType(candidate, "MemberExpression")) {
+		const propertyName = getStaticPropertyKeyName(candidate, { allowComputedString: true });
+		return Boolean(propertyName && NEXT_AFTER_EXPORT_NAMES.has(propertyName) && isNextServerNamespace(candidate.object, contextNode, scopes));
+	}
+	if (!isNodeOfType(candidate, "Identifier")) return false;
+	const symbol = scopes.symbolFor(candidate);
+	if (!symbol || visitedSymbolIds.has(symbol.id)) return false;
+	if (isNextAfterImportSymbol(symbol, contextNode)) return true;
+	const destructuredPropertyName = getDestructuredBindingPropertyName(symbol.bindingIdentifier);
+	if (symbol.kind === "const" && symbol.initializer && isDirectObjectPatternBinding(symbol) && destructuredPropertyName && NEXT_AFTER_EXPORT_NAMES.has(destructuredPropertyName)) return isNextServerNamespace(symbol.initializer, contextNode, scopes);
+	if (symbol.kind !== "const" || !symbol.initializer || !isNodeOfType(symbol.declarationNode, "VariableDeclarator") || symbol.declarationNode.id !== symbol.bindingIdentifier) return false;
+	visitedSymbolIds.add(symbol.id);
+	return isNextAfterCallee(symbol.initializer, contextNode, scopes, visitedSymbolIds);
+};
+const getDirectArgumentCall = (expression) => {
+	const expressionRoot = findTransparentExpressionRoot(expression);
+	const parent = expressionRoot.parent;
+	if (!isNodeOfType(parent, "CallExpression")) return null;
+	return parent.arguments[0] === expressionRoot ? parent : null;
+};
+const isScheduledByNextAfter = (expression, scopes) => {
+	const callExpression = getDirectArgumentCall(expression);
+	return Boolean(callExpression && isNextAfterCallee(callExpression.callee, callExpression, scopes));
+};
+const getFunctionBindingSymbol = (functionNode, scopes) => {
+	if (isNodeOfType(functionNode, "FunctionDeclaration") && functionNode.id) return scopes.scopeFor(functionNode).symbols.find((symbol) => symbol.declarationNode === functionNode) ?? null;
+	const functionRoot = findTransparentExpressionRoot(functionNode);
+	const parent = functionRoot.parent;
+	if (!isNodeOfType(parent, "VariableDeclarator") || parent.init !== functionRoot || !isNodeOfType(parent.id, "Identifier")) return null;
+	return scopes.symbolFor(parent.id);
+};
+const isDirectlyExported = (symbol) => {
+	let declaration = symbol.declarationNode;
+	if (isNodeOfType(declaration, "VariableDeclarator")) declaration = declaration.parent;
+	return Boolean(declaration?.parent && (isNodeOfType(declaration.parent, "ExportNamedDeclaration") || isNodeOfType(declaration.parent, "ExportDefaultDeclaration")));
+};
+const isLexicallyInsideFunction = (node, functionNode) => {
+	let enclosingFunction = findEnclosingFunction$1(node);
+	while (enclosingFunction) {
+		if (enclosingFunction === functionNode) return true;
+		enclosingFunction = findEnclosingFunction$1(enclosingFunction);
+	}
+	return false;
+};
+const isExclusivelyScheduledByNextAfter = (functionNode, scopes, visitedFunctionSymbolIds) => {
+	if (isScheduledByNextAfter(functionNode, scopes)) return true;
+	const functionSymbol = getFunctionBindingSymbol(functionNode, scopes);
+	if (!functionSymbol || isDirectlyExported(functionSymbol) || visitedFunctionSymbolIds.has(functionSymbol.id)) return false;
+	const nextVisitedFunctionSymbolIds = new Set(visitedFunctionSymbolIds).add(functionSymbol.id);
+	let hasAfterUse = false;
+	for (const reference of functionSymbol.references) {
+		if (reference.flag !== "read") return false;
+		if (isLexicallyInsideFunction(reference.identifier, functionNode)) continue;
+		if (isScheduledByNextAfter(reference.identifier, scopes)) {
+			hasAfterUse = true;
+			continue;
+		}
+		if (!isInsideNextAfterCallback(reference.identifier, scopes, nextVisitedFunctionSymbolIds)) return false;
+		hasAfterUse = true;
+	}
+	return hasAfterUse;
+};
+const isInsideNextAfterCallback = (node, scopes, visitedFunctionSymbolIds = /* @__PURE__ */ new Set()) => {
+	let enclosingFunction = findEnclosingFunction$1(node);
+	while (enclosingFunction) {
+		if (isExclusivelyScheduledByNextAfter(enclosingFunction, scopes, visitedFunctionSymbolIds)) return true;
+		enclosingFunction = findEnclosingFunction$1(enclosingFunction);
+	}
+	return false;
+};
 const serverAfterNonblocking = defineRule({
 	id: "server-after-nonblocking",
 	title: "Blocking side effect before response",
@@ -64979,6 +65086,7 @@ const serverAfterNonblocking = defineRule({
 				if (!objectName) return;
 				const methodName = node.callee.property.name;
 				if (!isDeferrableSideEffectCall(objectName, methodName)) return;
+				if (isInsideNextAfterCallback(node, context.scopes)) return;
 				context.report({
 					node,
 					message: `${objectName}.${methodName}() runs before the response, so your users wait longer for it.`
@@ -66253,17 +66361,34 @@ const stylePropObject = defineRule({
 		};
 	}
 });
+//#endregion
+//#region src/plugin/rules/security-scan/utils/has-use-server-directive-in-content.ts
+const hasUseServerDirectiveInContent = (content, relativePath = "source.tsx") => {
+	const programNode = parseSourceText({
+		filename: relativePath,
+		sourceText: content,
+		shouldAttachParentReferences: false
+	});
+	return programNode === null ? false : hasDirective(programNode, "use server");
+};
+//#endregion
+//#region src/plugin/rules/security-scan/supabase-client-owned-authz-field.ts
+const scanSupabaseClientOwnedAuthzField = scanByPattern({
+	shouldScan: (file) => isClientSourcePath(file.relativePath),
+	pattern: /\b(?:ownerId|ownerID|creatorId|creatorID|userId|userID|uid|providerId|providerID|orgId|orgID|tenantId|tenantID|teamId|teamID|workspaceId|workspaceID|ghostOrg|role|roles|isAdmin|admin)\b/,
+	requireAll: [/\b(?:supabase\b|\.from\s*\(\s*["'][^"']+["']\s*\))[\s\S]{0,700}\b(?:insert|upsert|update)\s*\(\s*(?:\{|\[?\s*\{)[\s\S]{0,700}\b(?:ownerId|creatorId|userId|orgId|tenantId|role|isAdmin)\b/i],
+	message: "Client Supabase code appears to write user, tenant, owner, or role fields that should be enforced by RLS."
+});
 const supabaseClientOwnedAuthzField = defineRule({
 	id: "supabase-client-owned-authz-field",
 	title: "Client writes Supabase authorization field",
 	severity: "error",
 	recommendation: "Use RLS policies based on `auth.uid()` and server-owned membership rows; do not trust client-provided owner, org, or role columns.",
-	scan: scanByPattern({
-		shouldScan: (file) => isClientSourcePath(file.relativePath),
-		pattern: /\b(?:ownerId|ownerID|creatorId|creatorID|userId|userID|uid|providerId|providerID|orgId|orgID|tenantId|tenantID|teamId|teamID|workspaceId|workspaceID|ghostOrg|role|roles|isAdmin|admin)\b/,
-		requireAll: [/\b(?:supabase\b|\.from\s*\(\s*["'][^"']+["']\s*\))[\s\S]{0,700}\b(?:insert|upsert|update)\s*\(\s*(?:\{|\[?\s*\{)[\s\S]{0,700}\b(?:ownerId|creatorId|userId|orgId|tenantId|role|isAdmin)\b/i],
-		message: "Client Supabase code appears to write user, tenant, owner, or role fields that should be enforced by RLS."
-	})
+	scan: (file) => {
+		const findings = scanSupabaseClientOwnedAuthzField(file);
+		if (findings.length === 0) return findings;
+		return hasUseServerDirectiveInContent(file.content, file.relativePath) ? [] : findings;
+	}
 });
 //#endregion
 //#region src/plugin/rules/security-scan/utils/is-supabase-migration-path.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oxlint-plugin-react-doctor",
-  "version": "0.7.9-dev.621be9b",
+  "version": "0.7.9-dev.6c5c91b",
   "description": "React Doctor rules for oxlint.",
   "keywords": [
     "accessibility",