pyric 0.1.0-alpha.21 → 0.1.0-alpha.24

package/src/rules/rtdb/grammar/linter.ts

@@ -5,59 +5,62 @@ import {
 } from '../expression-engine.js';
 import type { RuleLint } from '../types.js';
 
-let _warnings: RuleLint[] = [];
-let _lintContext: 'read' | 'write' | 'validate' = 'read';
-let _hasData = false;
-let _hasNewData = false;
-let _hasDataChildAccess = false;
+interface LintContext {
+  warnings: RuleLint[];
+  hasData: boolean;
+  hasNewData: boolean;
+  hasDataChildAccess: boolean;
+}
 
 let linterSemantics: Semantics | undefined;
 
 function getLinterSemantics(): Semantics {
   if (linterSemantics) return linterSemantics;
   const semantics = createRtdbExpressionSemantics();
-  semantics.addOperation('lint', {
+  semantics.addOperation('lint(ctx)', {
     _nonterminal(...children) {
-      children.forEach(c => (c as any).lint());
+      children.forEach(c => (c as any).lint(this.args.ctx));
     },
     _iter(...children) {
-      children.forEach(c => (c as any).lint());
+      children.forEach(c => (c as any).lint(this.args.ctx));
     },
     _terminal() {},
 
     CallExpr_methodCall(receiver, _dot, methodName, _open, args, _close) {
-      (receiver as any).lint();
-      args.asIteration().children.forEach((a: any) => (a as any).lint());
+      const ctx = this.args.ctx as LintContext;
+      (receiver as any).lint(ctx);
+      args.asIteration().children.forEach((a: any) => (a as any).lint(ctx));
       // Detect data.child() pattern — indicates intentional data comparison
       if (methodName.sourceString === 'child' && receiver.sourceString === 'data') {
-        _hasDataChildAccess = true;
+        ctx.hasDataChildAccess = true;
       }
     },
 
     ident(_dollar, _start, _rest) {
+      const ctx = this.args.ctx as LintContext;
       const name = this.sourceString;
-      if (name === 'data') _hasData = true;
-      if (name === 'newData') _hasNewData = true;
+      if (name === 'data') ctx.hasData = true;
+      if (name === 'newData') ctx.hasNewData = true;
     },
 
     bool_true(_true) {
-      _warnings.push({ code: 'HARDCODED_TRUE', message: 'Rule expression is hardcoded to true' });
+      const ctx = this.args.ctx as LintContext;
+      ctx.warnings.push({ code: 'HARDCODED_TRUE', message: 'Rule expression is hardcoded to true' });
     },
 
     bool_false(_false) {
-      _warnings.push({ code: 'HARDCODED_FALSE', message: 'Rule expression is hardcoded to false' });
+      const ctx = this.args.ctx as LintContext;
+      ctx.warnings.push({ code: 'HARDCODED_FALSE', message: 'Rule expression is hardcoded to false' });
     },
 
     Comparison_looseEq(left, _op, right) {
-      _warnings.push({ code: 'LOOSE_EQUALITY', message: "Use '===' instead of '=='" });
-      (left as any).lint();
-      (right as any).lint();
+      (left as any).lint(this.args.ctx);
+      (right as any).lint(this.args.ctx);
     },
 
     Comparison_looseNeq(left, _op, right) {
-      _warnings.push({ code: 'LOOSE_INEQUALITY', message: "Use '!==' instead of '!='" });
-      (left as any).lint();
-      (right as any).lint();
+      (left as any).lint(this.args.ctx);
+      (right as any).lint(this.args.ctx);
     },
   });
   linterSemantics = semantics;
@@ -71,20 +74,21 @@ export function lintExpression(
   const match = matchRtdbExpression(raw);
   if (match.failed()) return [];
 
-  _warnings = [];
-  _lintContext = context;
-  _hasData = false;
-  _hasNewData = false;
-  _hasDataChildAccess = false;
+  const ctx: LintContext = {
+    warnings: [],
+    hasData: false,
+    hasNewData: false,
+    hasDataChildAccess: false,
+  };
 
-  (getLinterSemantics()(match) as any).lint();
+  (getLinterSemantics()(match) as any).lint(ctx);
 
-  if (context === 'write' && _hasData && !_hasNewData && !_hasDataChildAccess) {
-    _warnings.push({
+  if (context === 'write' && ctx.hasData && !ctx.hasNewData && !ctx.hasDataChildAccess) {
+    ctx.warnings.push({
       code: 'DATA_IN_WRITE',
       message: "Write rule references 'data' but not 'newData'; consider using 'newData' to check incoming data",
     });
   }
 
-  return [..._warnings];
+  return ctx.warnings;
 }

package/src/rules/rtdb/grammar/simulator.ts

@@ -7,6 +7,9 @@ import {
 export interface SimulatedAuth {
   uid: string;
   token: Record<string, unknown>;
+  /** The sign-in method, which production reads from the token's
+   *  `firebase.sign_in_provider` claim. Absent when the token names none. */
+  provider?: string;
 }
 
 /** Property names that must never be read through rule member/index
@@ -55,6 +58,17 @@ function processStringEscapes(raw: string): string {
   return out;
 }
 
+export interface SimulatedQuery {
+  orderByChild?: string | null;
+  orderByKey?: boolean | null;
+  orderByValue?: boolean | null;
+  equalTo?: string | number | boolean | null;
+  limitToFirst?: number | null;
+  limitToLast?: number | null;
+  startAt?: string | number | boolean | null;
+  endAt?: string | number | boolean | null;
+}
+
 export interface EvalContext {
   auth: SimulatedAuth | null;
   data: DataSnapshot;
@@ -62,6 +76,38 @@ export interface EvalContext {
   root: DataSnapshot;
   now: number;
   pathVariableBindings: Record<string, string>;
+  query?: SimulatedQuery | null;
+}
+
+/** Whether `raw` is a JSON object node, as opposed to a leaf or null. */
+function isObjectNode(raw: unknown): raw is Record<string, unknown> {
+  return typeof raw === 'object' && raw !== null && !Array.isArray(raw);
+}
+
+/**
+ * A node's value as rules read it through `val()`: a `{ .value, .priority }`
+ * node reads as its `.value`, and `.priority` keys are dropped at every
+ * level, so a priority never shows up as data (capture rules-rtdb-r20). An
+ * object left with no children reads as null.
+ */
+function exportedValue(raw: unknown): unknown {
+  if (!isObjectNode(raw)) return raw ?? null;
+  if (Object.hasOwn(raw, '.value')) return exportedValue(raw['.value']);
+  const out: Record<string, unknown> = {};
+  for (const [key, child] of Object.entries(raw)) {
+    if (key === '.priority') continue;
+    const value = exportedValue(child);
+    if (value !== null) out[key] = value;
+  }
+  return Object.keys(out).length === 0 ? null : out;
+}
+
+/** A node's priority: its `.priority` number or string, else null. */
+function priorityOf(raw: unknown): number | string | null {
+  if (!isObjectNode(raw)) return null;
+  const priority = raw['.priority'];
+  const isPriority = typeof priority === 'number' || typeof priority === 'string';
+  return isPriority ? priority : null;
 }
 
 export class DataSnapshot {
@@ -76,11 +122,11 @@ export class DataSnapshot {
   }
 
   val(): unknown {
-    return this._value;
+    return exportedValue(this._value);
   }
 
   exists(): boolean {
-    return this._value !== null && this._value !== undefined;
+    return this.val() !== null;
   }
 
   hasChild(path: string): boolean {
@@ -94,23 +140,19 @@ export class DataSnapshot {
     if (Array.isArray(keys)) {
       return keys.every((key) => this.hasChild(String(key)));
     }
-    return (
-      typeof this._value === 'object' &&
-      this._value !== null &&
-      Object.keys(this._value as object).length > 0
-    );
+    return isObjectNode(this.val());
   }
 
   isString(): boolean {
-    return typeof this._value === 'string';
+    return typeof this.val() === 'string';
   }
 
   isNumber(): boolean {
-    return typeof this._value === 'number';
+    return typeof this.val() === 'number';
   }
 
   isBoolean(): boolean {
-    return typeof this._value === 'boolean';
+    return typeof this.val() === 'boolean';
   }
 
   child(path: string): DataSnapshot {
@@ -144,8 +186,8 @@ export class DataSnapshot {
     return rootSnap.child(parts.join('/'));
   }
 
-  getPriority(): null {
-    return null;
+  getPriority(): number | string | null {
+    return priorityOf(this._value);
   }
 }
 
@@ -197,59 +239,54 @@ class RtdbString {
   }
 }
 
-let _evalCtx: EvalContext = {
-  auth: null,
-  data: new DataSnapshot(null),
-  newData: new DataSnapshot(null),
-  root: new DataSnapshot(null),
-  now: Date.now(),
-  pathVariableBindings: {},
-};
-
 let evalSemantics: Semantics | undefined;
 
 function getEvalSemantics(): Semantics {
   if (evalSemantics) return evalSemantics;
   const semantics = createRtdbExpressionSemantics();
-  semantics.addOperation<unknown>('eval', {
-    Expr(node) { return (node as any).eval(); },
+  semantics.addOperation<unknown>('eval(ctx)', {
+    Expr(node) { return (node as any).eval(this.args.ctx); },
 
     Ternary_ternary(cond, _q, then, _c, els) {
-      return (cond as any).eval() ? (then as any).eval() : (els as any).eval();
+      return (cond as any).eval(this.args.ctx) ? (then as any).eval(this.args.ctx) : (els as any).eval(this.args.ctx);
+    },
+    Ternary(node) { return (node as any).eval(this.args.ctx); },
+
+    Logical_and(left, _op, right) { return (left as any).eval(this.args.ctx) && (right as any).eval(this.args.ctx); },
+    Logical_or(left, _op, right) { return (left as any).eval(this.args.ctx) || (right as any).eval(this.args.ctx); },
+    Logical(node) { return (node as any).eval(this.args.ctx); },
+
+    Comparison_gte(left, _op, right) { return (left as any).eval(this.args.ctx) >= (right as any).eval(this.args.ctx); },
+    Comparison_lte(left, _op, right) { return (left as any).eval(this.args.ctx) <= (right as any).eval(this.args.ctx); },
+    Comparison_gt(left, _op, right) { return (left as any).eval(this.args.ctx) > (right as any).eval(this.args.ctx); },
+    Comparison_lt(left, _op, right) { return (left as any).eval(this.args.ctx) < (right as any).eval(this.args.ctx); },
+    Comparison_looseEq(left, _op, right) { return (left as any).eval(this.args.ctx) == (right as any).eval(this.args.ctx); },
+    Comparison_looseNeq(left, _op, right) { return (left as any).eval(this.args.ctx) != (right as any).eval(this.args.ctx); },
+    Comparison(node) { return (node as any).eval(this.args.ctx); },
+
+    Additive_add(left, _op, right) { return (left as any).eval(this.args.ctx) as number + ((right as any).eval(this.args.ctx) as number); },
+    Additive_sub(left, _op, right) { return (left as any).eval(this.args.ctx) as number - ((right as any).eval(this.args.ctx) as number); },
+    Additive(node) { return (node as any).eval(this.args.ctx); },
+
+    Multiplicative_mul(left, _op, right) { return (left as any).eval(this.args.ctx) as number * ((right as any).eval(this.args.ctx) as number); },
+    Multiplicative_div(left, _op, right) { return (left as any).eval(this.args.ctx) as number / ((right as any).eval(this.args.ctx) as number); },
+    Multiplicative_mod(left, _op, right) { return (left as any).eval(this.args.ctx) as number % ((right as any).eval(this.args.ctx) as number); },
+    Multiplicative(node) { return (node as any).eval(this.args.ctx); },
+
+    UnaryExpr_not(_op, expr) {
+      const val = (expr as any).eval(this.args.ctx);
+      if (typeof val !== 'boolean') {
+        return false;
+      }
+      return !val;
     },
-    Ternary(node) { return (node as any).eval(); },
-
-    Logical_and(left, _op, right) { return (left as any).eval() && (right as any).eval(); },
-    Logical_or(left, _op, right) { return (left as any).eval() || (right as any).eval(); },
-    Logical(node) { return (node as any).eval(); },
-
-    Comparison_strictEq(left, _op, right) { return (left as any).eval() === (right as any).eval(); },
-    Comparison_strictNeq(left, _op, right) { return (left as any).eval() !== (right as any).eval(); },
-    Comparison_gte(left, _op, right) { return (left as any).eval() >= (right as any).eval(); },
-    Comparison_lte(left, _op, right) { return (left as any).eval() <= (right as any).eval(); },
-    Comparison_gt(left, _op, right) { return (left as any).eval() > (right as any).eval(); },
-    Comparison_lt(left, _op, right) { return (left as any).eval() < (right as any).eval(); },
-    Comparison_looseEq(left, _op, right) { return (left as any).eval() == (right as any).eval(); },
-    Comparison_looseNeq(left, _op, right) { return (left as any).eval() != (right as any).eval(); },
-    Comparison(node) { return (node as any).eval(); },
-
-    Additive_add(left, _op, right) { return (left as any).eval() as number + ((right as any).eval() as number); },
-    Additive_sub(left, _op, right) { return (left as any).eval() as number - ((right as any).eval() as number); },
-    Additive(node) { return (node as any).eval(); },
-
-    Multiplicative_mul(left, _op, right) { return (left as any).eval() as number * ((right as any).eval() as number); },
-    Multiplicative_div(left, _op, right) { return (left as any).eval() as number / ((right as any).eval() as number); },
-    Multiplicative_mod(left, _op, right) { return (left as any).eval() as number % ((right as any).eval() as number); },
-    Multiplicative(node) { return (node as any).eval(); },
-
-    UnaryExpr_not(_op, expr) { return !(expr as any).eval(); },
-    UnaryExpr_neg(_op, expr) { return -((expr as any).eval() as number); },
-    UnaryExpr(node) { return (node as any).eval(); },
+    UnaryExpr_neg(_op, expr) { return -((expr as any).eval(this.args.ctx) as number); },
+    UnaryExpr(node) { return (node as any).eval(this.args.ctx); },
 
     CallExpr_methodCall(receiver, _dot, methodName, _open, args, _close) {
-      const recv = (receiver as any).eval();
+      const recv = (receiver as any).eval(this.args.ctx);
       const method = methodName.sourceString;
-      const argValues = (args as any).asIteration().children.map((a: any) => (a as any).eval());
+      const argValues = (args as any).asIteration().children.map((a: any) => (a as any).eval(this.args.ctx));
 
       if (recv instanceof DataSnapshot) {
         switch (method) {
@@ -291,33 +328,33 @@ function getEvalSemantics(): Semantics {
     },
 
     CallExpr_memberAccess(receiver, _dot, member) {
-      const recv = (receiver as any).eval();
+      const recv = (receiver as any).eval(this.args.ctx);
       if (recv === null || recv === undefined) return null;
       return safeMemberRead(recv, member.sourceString);
     },
 
     CallExpr_indexAccess(receiver, _open, index, _close) {
-      const recv = (receiver as any).eval();
-      const idx = (index as any).eval();
+      const recv = (receiver as any).eval(this.args.ctx);
+      const idx = (index as any).eval(this.args.ctx);
       if (recv === null || recv === undefined) return null;
       return safeMemberRead(recv, String(idx));
     },
 
-    CallExpr(node) { return (node as any).eval(); },
+    CallExpr(node) { return (node as any).eval(this.args.ctx); },
 
-    Primary_paren(_open, expr, _close) { return (expr as any).eval(); },
-    Primary(node) { return (node as any).eval(); },
+    Primary_paren(_open, expr, _close) { return (expr as any).eval(this.args.ctx); },
+    Primary(node) { return (node as any).eval(this.args.ctx); },
 
     Array(_open, elems, _close) {
-      return (elems as any).asIteration().children.map((e: any) => (e as any).eval());
+      return (elems as any).asIteration().children.map((e: any) => (e as any).eval(this.args.ctx));
     },
 
-    literal(node) { return (node as any).eval(); },
+    literal(node) { return (node as any).eval(this.args.ctx); },
 
     number_float(_int, _dot, _frac, _exp) { return parseFloat(this.sourceString); },
     number_exp(_digits, _exp) { return parseFloat(this.sourceString); },
     number_int(_digits) { return parseInt(this.sourceString, 10); },
-    number(node) { return (node as any).eval(); },
+    number(node) { return (node as any).eval(this.args.ctx); },
 
     string_double(_open, _chars, _close) {
       return JSON.parse(this.sourceString);
@@ -325,7 +362,7 @@ function getEvalSemantics(): Semantics {
     string_single(_open, chars, _close) {
       return processStringEscapes(chars.sourceString);
     },
-    string(node) { return (node as any).eval(); },
+    string(node) { return (node as any).eval(this.args.ctx); },
 
     regex(_slash1, body, _slash2, flags) {
       return new RegExp(body.sourceString, flags.sourceString);
@@ -333,21 +370,23 @@ function getEvalSemantics(): Semantics {
 
     bool_true(_lit) { return true; },
     bool_false(_lit) { return false; },
-    bool(node) { return (node as any).eval(); },
+    bool(node) { return (node as any).eval(this.args.ctx); },
 
     null(_lit) { return null; },
 
     ident(_dollar, _start, _rest) {
+      const ctx = this.args.ctx as EvalContext;
       const name = this.sourceString;
-      if (name in _evalCtx.pathVariableBindings) {
-        return _evalCtx.pathVariableBindings[name];
+      if (ctx?.pathVariableBindings && name in ctx.pathVariableBindings) {
+        return ctx.pathVariableBindings[name];
       }
       switch (name) {
-        case 'auth': return _evalCtx.auth;
-        case 'data': return _evalCtx.data;
-        case 'newData': return _evalCtx.newData;
-        case 'root': return _evalCtx.root;
-        case 'now': return _evalCtx.now;
+        case 'auth': return ctx?.auth ?? null;
+        case 'data': return ctx?.data;
+        case 'newData': return ctx?.newData;
+        case 'root': return ctx?.root;
+        case 'now': return ctx?.now;
+        case 'query': return ctx?.query ?? null;
         default: return undefined;
       }
     },
@@ -361,6 +400,5 @@ export function evaluateRtdbExpression(raw: string, ctx: EvalContext): unknown {
   if (match.failed()) {
     throw new Error(match.message ?? 'RTDB expression failed to parse');
   }
-  _evalCtx = ctx;
-  return (getEvalSemantics()(match) as any).eval();
+  return (getEvalSemantics()(match) as any).eval(ctx);
 }

package/src/rules/rtdb/grammar/validator.ts

@@ -6,7 +6,7 @@ import {
 import type { RuleError } from '../types.js';
 
 const ALLOWED_IDENTIFIERS: Record<string, Set<string>> = {
-  read: new Set(['auth', 'data', 'root', 'now']),
+  read: new Set(['auth', 'data', 'root', 'now', 'query']),
   write: new Set(['auth', 'data', 'newData', 'root', 'now']),
   validate: new Set(['auth', 'data', 'newData', 'root', 'now']),
 };
@@ -23,69 +23,71 @@ const STRING_METHODS = new Set([
 
 const ALL_KNOWN_METHODS = new Set([...DATASNAPSHOT_METHODS, ...STRING_METHODS]);
 
-let _errors: RuleError[] = [];
-let _context: 'read' | 'write' | 'validate' = 'read';
-let _pathVars: Set<string> = new Set();
-// Track whether we're inside a CallExpr_methodCall (to skip method name ident validation)
-let _skipNextIdent = false;
+interface ValidateContext {
+  errors: RuleError[];
+  context: 'read' | 'write' | 'validate';
+  pathVars: Set<string>;
+}
 
 let validatorSemantics: Semantics | undefined;
 
 function getValidatorSemantics(): Semantics {
   if (validatorSemantics) return validatorSemantics;
   const semantics = createRtdbExpressionSemantics();
-  semantics.addOperation('validate', {
+  semantics.addOperation('validate(ctx)', {
     _nonterminal(...children) {
-      children.forEach(c => (c as any).validate());
+      children.forEach(c => (c as any).validate(this.args.ctx));
     },
     _iter(...children) {
-      children.forEach(c => (c as any).validate());
+      children.forEach(c => (c as any).validate(this.args.ctx));
     },
     _terminal() {},
 
     CallExpr_methodCall(receiver, _dot, methodName, _open, args, _close) {
-      (receiver as any).validate();
+      const ctx = this.args.ctx as ValidateContext;
+      (receiver as any).validate(ctx);
       // Validate method name
       const method = methodName.sourceString;
       if (!ALL_KNOWN_METHODS.has(method)) {
-        _errors.push({
+        ctx.errors.push({
           code: 'UNKNOWN_METHOD',
           message: `Unknown method '${method}'`,
         });
       }
       // Recurse into args but NOT methodName (it's not an identifier in this context)
-      args.asIteration().children.forEach((a: any) => (a as any).validate());
+      args.asIteration().children.forEach((a: any) => (a as any).validate(ctx));
     },
 
     CallExpr_memberAccess(receiver, _dot, _member) {
-      (receiver as any).validate();
+      (receiver as any).validate(this.args.ctx);
       // Skip validation of member name - it's a property, not a root identifier
     },
 
     CallExpr_indexAccess(receiver, _open, index, _close) {
-      (receiver as any).validate();
-      (index as any).validate();
+      (receiver as any).validate(this.args.ctx);
+      (index as any).validate(this.args.ctx);
     },
 
     ident(_dollar, _start, _rest) {
+      const ctx = this.args.ctx as ValidateContext;
       const name = this.sourceString;
       const dollar = _dollar.sourceString;
 
       // Path variables (starting with $) are always valid
       if (dollar === '$') return;
 
-      const allowed = ALLOWED_IDENTIFIERS[_context];
+      const allowed = ALLOWED_IDENTIFIERS[ctx.context];
       if (!allowed) return;
 
-      if (!allowed.has(name) && !_pathVars.has(name)) {
-        _errors.push({
+      if (!allowed.has(name) && !ctx.pathVars.has(name)) {
+        ctx.errors.push({
           code: 'UNKNOWN_IDENTIFIER',
-          message: `Identifier '${name}' is not allowed in '${_context}' context`,
+          message: `Identifier '${name}' is not allowed in '${ctx.context}' context`,
         });
       }
 
-      if (name === 'newData' && _context === 'read') {
-        _errors.push({
+      if (name === 'newData' && ctx.context === 'read') {
+        ctx.errors.push({
           code: 'NEWDATA_IN_READ',
           message: `'newData' is not available in 'read' context`,
         });
@@ -104,10 +106,12 @@ export function validateExpression(
   const match = matchRtdbExpression(raw);
   if (match.failed()) return [];
 
-  _errors = [];
-  _context = context;
-  _pathVars = new Set(pathVariables.map(v => v.startsWith('$') ? v.slice(1) : v));
+  const ctx: ValidateContext = {
+    errors: [],
+    context,
+    pathVars: new Set(pathVariables.map(v => v.startsWith('$') ? v.slice(1) : v)),
+  };
 
-  (getValidatorSemantics()(match) as any).validate();
-  return [..._errors];
+  (getValidatorSemantics()(match) as any).validate(ctx);
+  return ctx.errors;
 }