technical-debt-radar 1.6.4 → 1.7.0

package/dist/index.js

@@ -12888,6 +12888,7 @@ var require_boundary_checker = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.checkBoundaries = checkBoundaries;
+    exports2._resetPathAliasCache = _resetPathAliasCache;
     var shared_1 = require_dist();
     var minimatch_1 = require_commonjs3();
     var ts_morph_1 = require("ts-morph");
@@ -13191,10 +13192,15 @@ var require_boundary_checker = __commonJS({
           specifiers.push(reqSpec);
         }
         for (const { specifier, line, typeOnly } of specifiers) {
-          if (!specifier.startsWith(".") && !specifier.startsWith("/"))
+          let resolvedTarget;
+          if (specifier.startsWith(".") || specifier.startsWith("/")) {
+            const sourceDir = filePath.replace(/\/[^/]+$/, "");
+            resolvedTarget = resolveRelativePath(sourceDir, specifier);
+          } else {
+            resolvedTarget = resolvePathAliasForBoundary(specifier, input);
+          }
+          if (!resolvedTarget)
             continue;
-          const sourceDir = filePath.replace(/\/[^/]+$/, "");
-          const resolvedTarget = resolveRelativePath(sourceDir, specifier);
           const targetModule = findModuleForFile(resolvedTarget, policy);
           if (!targetModule || targetModule === sourceModule)
             continue;
@@ -13379,6 +13385,82 @@ var require_boundary_checker = __commonJS({
       const normalized = normalizeForMatching(file);
       return exceptions.some((exc) => exc.rule === ruleId && ((0, minimatch_1.minimatch)(file, exc.file) || (0, minimatch_1.minimatch)(normalized, exc.file)));
     }
+    var _cachedAliases;
+    function parsePathAliasesFromProject(input) {
+      if (_cachedAliases)
+        return _cachedAliases;
+      let tsconfigContent;
+      const tsconfigFile = input.changedFiles.find((f) => f.status !== "deleted" && /tsconfig(?:\.build|\.app)?\.json$/.test(f.path));
+      if (tsconfigFile) {
+        tsconfigContent = tsconfigFile.content;
+      }
+      const root = input.projectRoot;
+      if (!tsconfigContent && root) {
+        try {
+          const fs9 = require("fs");
+          const path9 = require("path");
+          for (const name of ["tsconfig.json", "tsconfig.app.json", "tsconfig.build.json"]) {
+            const tsconfigPath = path9.join(root, name);
+            if (fs9.existsSync(tsconfigPath)) {
+              tsconfigContent = fs9.readFileSync(tsconfigPath, "utf-8");
+              break;
+            }
+          }
+        } catch {
+        }
+      }
+      if (!tsconfigContent) {
+        _cachedAliases = [];
+        return _cachedAliases;
+      }
+      try {
+        const stripped = tsconfigContent.replace(/\/\/.*$/gm, "").replace(/\/\*[\s\S]*?\*\//g, "").replace(/,\s*([}\]])/g, "$1");
+        const tsconfig = JSON.parse(stripped);
+        const compilerOptions = tsconfig.compilerOptions ?? {};
+        const rawBaseUrl = (compilerOptions.baseUrl ?? ".").replace(/\/+$/, "");
+        const baseUrl = rawBaseUrl === "" ? "." : rawBaseUrl;
+        const paths = compilerOptions.paths ?? {};
+        const aliases = [];
+        for (const [pattern, targets] of Object.entries(paths)) {
+          const prefix = pattern.replace(/\/?\*$/, "");
+          const resolvedTargets = targets.map((t) => {
+            const target = t.replace(/\/?\*$/, "");
+            if (baseUrl !== "." && !target.startsWith("/")) {
+              return (baseUrl + "/" + target).replace(/\/+/g, "/");
+            }
+            return target;
+          });
+          aliases.push({ prefix, targets: resolvedTargets });
+        }
+        _cachedAliases = aliases;
+        return aliases;
+      } catch {
+        _cachedAliases = [];
+        return _cachedAliases;
+      }
+    }
+    function resolvePathAliasForBoundary(specifier, input) {
+      const aliases = parsePathAliasesFromProject(input);
+      for (const alias of aliases) {
+        if (alias.prefix === "" || specifier === alias.prefix || specifier.startsWith(alias.prefix + "/")) {
+          const remainder = alias.prefix === "" ? specifier : specifier.slice(alias.prefix.length).replace(/^\//, "");
+          for (const target of alias.targets) {
+            const candidate = remainder ? target ? target + "/" + remainder : remainder : target;
+            if (candidate.startsWith("src/") || candidate.startsWith("lib/") || candidate.startsWith("app/")) {
+              return candidate;
+            }
+          }
+        }
+      }
+      if (specifier.startsWith("@/"))
+        return "src/" + specifier.slice(2);
+      if (specifier.startsWith("~/"))
+        return "src/" + specifier.slice(2);
+      return void 0;
+    }
+    function _resetPathAliasCache() {
+      _cachedAliases = void 0;
+    }
     function normalizeForMatching(filePath) {
       let normalized = filePath.replace(/\\/g, "/");
       if (normalized.startsWith("/")) {
@@ -15332,6 +15414,13 @@ var require_perf_pattern_detector = __commonJS({
           entity = extractTypeORMEntity(node);
         if (!entity)
           entity = extractSequelizeEntity(node);
+        if (methodName === "find") {
+          const typeormEntity = extractTypeORMEntity(node);
+          const seqEntity = extractSequelizeEntity(node);
+          if (!typeormEntity && !seqEntity)
+            return;
+          entity = typeormEntity ?? seqEntity;
+        }
         const vol = entity ? resolveVolume(entity, policy) : void 0;
         const fn = getEnclosingFn(node, fns);
         pushIfNotNull(violations, makeViolation(shared_1.PERFORMANCE_RULES.UNBOUNDED_FIND_MANY, filePath, node.getStartLineNumber(), `${methodName}() without take/limit${vol ? ` on '${entity}' (${vol.size} volume)` : ""} \u2014 may fetch entire table`, policy, vol, fn?.name, "Add take: N or limit to bound the result set"));
@@ -15437,6 +15526,8 @@ var require_perf_pattern_detector = __commonJS({
           entity = extractTypeORMEntity(node);
         if (!entity)
           entity = extractSequelizeEntity(node);
+        if (methodName === "find")
+          return;
         const vol = entity ? resolveVolume(entity, policy) : void 0;
         const hasCursorPagination = argsContainKey(node, "cursor");
         const hasTakePagination = argsContainKey(node, "take") || argsContainKey(node, "limit");
@@ -16241,6 +16332,7 @@ var require_reliability_detector = __commonJS({
     exports2.detectReliabilityIssues = detectReliabilityIssues;
     var shared_1 = require_dist();
     var ts_morph_1 = require("ts-morph");
+    var minimatch_1 = require_commonjs3();
     async function detectReliabilityIssues(input, policy) {
       const violations = [];
       const project = new ts_morph_1.Project({ useInMemoryFileSystem: true });
@@ -16271,6 +16363,10 @@ var require_reliability_detector = __commonJS({
         detectUnboundedParallelCalls(sourceFile, file.path, fns, policy, violations);
         project.removeSourceFile(sourceFile);
       }
+      if (/mongoose/i.test(policy.stack.orm)) {
+        const schemaViolations = detectQueryNonexistentField(input);
+        violations.push(...schemaViolations);
+      }
       return applyExceptions(deduplicateOverlapping(violations), policy);
     }
     function deduplicateOverlapping(violations) {
@@ -16670,9 +16766,11 @@ var require_reliability_detector = __commonJS({
           continue;
         let unhandledAwaitCount = 0;
         let totalAwaitCount = 0;
-        fn.node.forEachDescendant((child) => {
-          if (child !== fn.node && (ts_morph_1.Node.isFunctionDeclaration(child) || ts_morph_1.Node.isMethodDeclaration(child) || ts_morph_1.Node.isArrowFunction(child) || ts_morph_1.Node.isFunctionExpression(child)))
+        fn.node.forEachDescendant((child, traversal) => {
+          if (child !== fn.node && (ts_morph_1.Node.isFunctionDeclaration(child) || ts_morph_1.Node.isMethodDeclaration(child) || ts_morph_1.Node.isArrowFunction(child) || ts_morph_1.Node.isFunctionExpression(child))) {
+            traversal.skip();
             return;
+          }
           if (!ts_morph_1.Node.isAwaitExpression(child))
             return;
           totalAwaitCount++;
@@ -17189,9 +17287,44 @@ var require_reliability_detector = __commonJS({
         });
       });
     }
+    function stripToSrcRoot(filePath) {
+      const markers = ["src/", "apps/", "lib/", "packages/"];
+      for (const marker of markers) {
+        const idx = filePath.indexOf(marker);
+        if (idx >= 0)
+          return filePath.slice(idx);
+      }
+      return filePath;
+    }
+    function resolveRelativeImport(sourceDir, specifier) {
+      const parts = (sourceDir + "/" + specifier).split("/");
+      const resolved = [];
+      for (const part of parts) {
+        if (part === "." || part === "")
+          continue;
+        if (part === "..")
+          resolved.pop();
+        else
+          resolved.push(part);
+      }
+      return resolved.join("/");
+    }
+    function findModuleName(filePath, policy) {
+      const normalized = filePath.replace(/\\/g, "/");
+      const stripped = normalized.startsWith("/") ? normalized.slice(1) : normalized;
+      for (const mod of policy.modules) {
+        if ((0, minimatch_1.minimatch)(stripped, mod.pathPattern) || (0, minimatch_1.minimatch)(normalized, mod.pathPattern)) {
+          return mod.name;
+        }
+      }
+      const match = stripped.match(/^src\/([^/]+)/);
+      return match ? match[1] : void 0;
+    }
     function detectProviderOutsideHomeModule(sourceFile, filePath, allFiles, policy, violations) {
       if (!filePath.endsWith(".module.ts") && !filePath.endsWith(".module.js"))
         return;
+      if (!/nestjs/i.test(policy.stack.framework))
+        return;
       sourceFile.forEachDescendant((node) => {
         if (!ts_morph_1.Node.isDecorator(node) || node.getName() !== "Module")
           return;
@@ -17222,24 +17355,40 @@ var require_reliability_detector = __commonJS({
             if (!matchingImport)
               continue;
             const specifier = importDecl.getModuleSpecifierValue();
+            let resolvedPath;
             if (specifier.startsWith(".") || specifier.startsWith("/")) {
-              const resolvedPath = specifier.replace(/^\.\//, moduleFolder + "/").replace(/^\.\.\//, moduleFolder + "/../");
-              if (!resolvedPath.startsWith(moduleFolder) && !specifier.startsWith("./")) {
-                violations.push({
-                  category: "architecture",
-                  type: shared_1.ARCHITECTURE_RULES.PROVIDER_OUTSIDE_HOME,
-                  ruleId: shared_1.ARCHITECTURE_RULES.PROVIDER_OUTSIDE_HOME,
-                  severity: "warning",
-                  source: "deterministic",
-                  confidence: "high",
-                  file: filePath,
-                  line: element.getStartLineNumber(),
-                  message: `Provider '${providerName}' is imported from outside this module's folder \u2014 consider moving it to its home module or a shared module`,
-                  suggestion: `Move ${providerName} to this module's folder or register it in the module where it's defined`,
-                  debtPoints: 3,
-                  gateAction: "warn"
-                });
-              }
+              resolvedPath = resolveRelativeImport(moduleFolder, specifier);
+            } else if (specifier.startsWith("@/")) {
+              resolvedPath = "src/" + specifier.slice(2);
+            } else if (specifier.startsWith("~/")) {
+              resolvedPath = "src/" + specifier.slice(2);
+            }
+            if (!resolvedPath)
+              continue;
+            const normalizedModule = stripToSrcRoot(moduleFolder.replace(/\\/g, "/"));
+            const normalizedResolved = stripToSrcRoot(resolvedPath.replace(/\\/g, "/"));
+            const isFromOutside = !normalizedResolved.startsWith(normalizedModule + "/") && normalizedResolved !== normalizedModule;
+            const sharedFolders = ["shared", "common", "utils", "config", "guards", "interceptors", "decorators", "pipes", "filters", "strategies"];
+            const isShared = sharedFolders.some((f) => normalizedResolved.includes("/" + f + "/"));
+            if (isFromOutside && !isShared) {
+              const sourceModuleName = findModuleName(normalizedResolved, policy);
+              const targetModuleName = findModuleName(filePath, policy);
+              const moduleInfo = sourceModuleName ? ` (${sourceModuleName} module)` : "";
+              const targetInfo = targetModuleName ? ` (${targetModuleName} module)` : "";
+              violations.push({
+                category: "architecture",
+                type: shared_1.ARCHITECTURE_RULES.PROVIDER_OUTSIDE_HOME,
+                ruleId: shared_1.ARCHITECTURE_RULES.PROVIDER_OUTSIDE_HOME,
+                severity: "warning",
+                source: "deterministic",
+                confidence: "high",
+                file: filePath,
+                line: element.getStartLineNumber(),
+                message: `Provider '${providerName}'${moduleInfo} is registered outside its home module${targetInfo} \u2014 move it to its home module's providers and export it`,
+                suggestion: `Move ${providerName} to its home module's providers array and export it, then import that module here`,
+                debtPoints: 3,
+                gateAction: "warn"
+              });
             }
           }
         }
@@ -17396,6 +17545,163 @@ var require_reliability_detector = __commonJS({
     function escapeRegex(str) {
       return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     }
+    var MONGOOSE_QUERY_METHODS = /* @__PURE__ */ new Set([
+      "find",
+      "findOne",
+      "findById",
+      "findOneAndUpdate",
+      "findOneAndDelete",
+      "findOneAndReplace",
+      "findOneAndRemove",
+      "findByIdAndUpdate",
+      "findByIdAndDelete",
+      "updateOne",
+      "updateMany",
+      "deleteOne",
+      "deleteMany",
+      "countDocuments",
+      "exists",
+      "distinct"
+    ]);
+    var BUILTIN_FIELDS = /* @__PURE__ */ new Set(["_id", "__v", "id", "createdAt", "updatedAt"]);
+    function detectQueryNonexistentField(input) {
+      const violations = [];
+      const project = new ts_morph_1.Project({ useInMemoryFileSystem: true });
+      const schemaFieldMap = /* @__PURE__ */ new Map();
+      for (const file of input.changedFiles) {
+        if (file.status === "deleted")
+          continue;
+        if (!/\.schema\.(ts|js)$/.test(file.path) && !/schemas?\//.test(file.path))
+          continue;
+        if (!/\.(ts|tsx|js|jsx)$/.test(file.path))
+          continue;
+        const sf = project.createSourceFile(file.path, file.content);
+        for (const cls of sf.getClasses()) {
+          const schemaDecorator = cls.getDecorators().find((d) => d.getName() === "Schema");
+          if (!schemaDecorator)
+            continue;
+          const schemaName = cls.getName();
+          if (!schemaName)
+            continue;
+          const fields = new Set(BUILTIN_FIELDS);
+          for (const prop of cls.getProperties()) {
+            if (prop.getDecorators().some((d) => d.getName() === "Prop")) {
+              fields.add(prop.getName());
+            }
+          }
+          const schemaArgs = schemaDecorator.getCallExpression?.()?.getArguments();
+          if (schemaArgs && schemaArgs.length > 0) {
+            const argText = schemaArgs[0].getText();
+            if (/timestamps\s*:\s*true/.test(argText)) {
+              fields.add("createdAt");
+              fields.add("updatedAt");
+            }
+          }
+          schemaFieldMap.set(schemaName, fields);
+        }
+        project.removeSourceFile(sf);
+      }
+      if (schemaFieldMap.size === 0)
+        return violations;
+      for (const file of input.changedFiles) {
+        if (file.status === "deleted")
+          continue;
+        if (!/\.(ts|tsx|js|jsx)$/.test(file.path))
+          continue;
+        if (/\.schema\.(ts|js)$/.test(file.path))
+          continue;
+        const sf = project.createSourceFile(file.path, file.content);
+        const modelToSchema = /* @__PURE__ */ new Map();
+        for (const cls of sf.getClasses()) {
+          const ctors = cls.getConstructors();
+          for (const ctor of ctors) {
+            for (const param of ctor.getParameters()) {
+              const injectModel = param.getDecorators().find((d) => d.getName() === "InjectModel");
+              if (!injectModel)
+                continue;
+              const callExpr = injectModel.getCallExpression?.();
+              if (!callExpr)
+                continue;
+              const args = callExpr.getArguments();
+              if (args.length === 0)
+                continue;
+              let schemaName = args[0].getText();
+              schemaName = schemaName.replace(/\.name$/, "").replace(/['"]/g, "");
+              const paramName = param.getName();
+              modelToSchema.set(paramName, schemaName);
+            }
+          }
+        }
+        if (modelToSchema.size === 0) {
+          project.removeSourceFile(sf);
+          continue;
+        }
+        sf.forEachDescendant((node) => {
+          if (!ts_morph_1.Node.isCallExpression(node))
+            return;
+          const expr = node.getExpression();
+          if (!ts_morph_1.Node.isPropertyAccessExpression(expr))
+            return;
+          const methodName = expr.getName();
+          if (!MONGOOSE_QUERY_METHODS.has(methodName))
+            return;
+          const obj = expr.getExpression();
+          if (!ts_morph_1.Node.isPropertyAccessExpression(obj))
+            return;
+          const propName = obj.getName();
+          const thisExpr = obj.getExpression();
+          if (thisExpr.getKind() !== ts_morph_1.SyntaxKind.ThisKeyword)
+            return;
+          const schemaName = modelToSchema.get(propName);
+          if (!schemaName)
+            return;
+          const schemaFields = schemaFieldMap.get(schemaName);
+          if (!schemaFields)
+            return;
+          const args = node.getArguments();
+          if (args.length === 0)
+            return;
+          const filterArg = args[0];
+          if (!ts_morph_1.Node.isObjectLiteralExpression(filterArg))
+            return;
+          for (const prop of filterArg.getProperties()) {
+            if (!ts_morph_1.Node.isPropertyAssignment(prop))
+              continue;
+            const nameNode = prop.getNameNode();
+            let fieldName;
+            if (ts_morph_1.Node.isStringLiteral(nameNode)) {
+              fieldName = nameNode.getLiteralValue();
+            } else if (ts_morph_1.Node.isIdentifier(nameNode)) {
+              fieldName = nameNode.getText();
+            } else if (ts_morph_1.Node.isComputedPropertyName(nameNode)) {
+              continue;
+            } else {
+              fieldName = nameNode.getText();
+            }
+            const rootField = fieldName.split(".")[0];
+            if (!schemaFields.has(rootField)) {
+              const availableFields = [...schemaFields].filter((f) => !BUILTIN_FIELDS.has(f) || f === "_id").sort().join(", ");
+              violations.push({
+                category: "reliability",
+                type: "query-references-nonexistent-field",
+                ruleId: "query-references-nonexistent-field",
+                severity: "critical",
+                source: "deterministic",
+                confidence: "high",
+                file: file.path,
+                line: prop.getStartLineNumber(),
+                message: `Query filter references field '${fieldName}' which does not exist in ${schemaName} schema \u2014 available fields: ${availableFields}`,
+                suggestion: `Check the ${schemaName} schema definition for the correct field name`,
+                debtPoints: 8,
+                gateAction: "block"
+              });
+            }
+          }
+        });
+        project.removeSourceFile(sf);
+      }
+      return violations;
+    }
     function applyExceptions(violations, policy) {
       return violations.filter((v) => !policy.exceptions.some((ex) => ex.isActive && ex.rule === v.ruleId && v.file.includes(ex.file)));
     }
@@ -18463,6 +18769,8 @@ var require_dead_code_detector = __commonJS({
         debtPoints: 1,
         gateAction: "warn"
       }));
+      const unusedMethodViolations = detectUnusedPublicMethods(sourceFiles, input);
+      violations.push(...unusedMethodViolations);
       const totalExports = Array.from(allExports.values()).reduce((sum, exps) => sum + exps.length, 0);
       return {
         unusedExports,
@@ -18818,6 +19126,121 @@ var require_dead_code_detector = __commonJS({
       }
       return result.join("/");
     }
+    var NESTJS_METHOD_DECORATORS = /* @__PURE__ */ new Set([
+      "Get",
+      "Post",
+      "Put",
+      "Patch",
+      "Delete",
+      "Options",
+      "Head",
+      "All",
+      "Cron",
+      "OnEvent",
+      "Process",
+      "OnQueueActive",
+      "OnQueueCompleted",
+      "OnQueueFailed",
+      "SubscribeMessage",
+      "OnGatewayInit",
+      "OnGatewayConnection",
+      "OnGatewayDisconnect",
+      "EventPattern",
+      "MessagePattern",
+      "GrpcMethod"
+    ]);
+    var LIFECYCLE_HOOKS = /* @__PURE__ */ new Set([
+      "onModuleInit",
+      "onModuleDestroy",
+      "onApplicationBootstrap",
+      "onApplicationShutdown",
+      "beforeApplicationShutdown",
+      "afterInit",
+      "handleConnection",
+      "handleDisconnect",
+      "validate",
+      // Passport strategy method — called by framework
+      "canActivate",
+      // Guard method
+      "intercept",
+      // Interceptor method
+      "transform",
+      // Pipe method
+      "catch",
+      // Exception filter method
+      "use"
+      // Middleware method
+    ]);
+    function detectUnusedPublicMethods(sourceFiles, input) {
+      const violations = [];
+      const isNestJS = /nestjs/i.test(input.policy.stack.framework);
+      const allFileTexts = /* @__PURE__ */ new Map();
+      for (const [filePath, sf] of sourceFiles) {
+        allFileTexts.set(filePath, sf.getFullText());
+      }
+      for (const [filePath, sf] of sourceFiles) {
+        if (/\.(spec|test)\./i.test(filePath))
+          continue;
+        if (/\.module\./i.test(filePath))
+          continue;
+        for (const cls of sf.getClasses()) {
+          const hasInjectable = cls.getDecorators().some((d) => d.getName() === "Injectable");
+          if (!hasInjectable)
+            continue;
+          const baseClass = cls.getExtends()?.getText() ?? "";
+          if (/PassportStrategy|Strategy/.test(baseClass))
+            continue;
+          const className = cls.getName();
+          if (!className)
+            continue;
+          for (const method of cls.getMethods()) {
+            const methodName = method.getName();
+            if (!methodName || methodName.startsWith("_"))
+              continue;
+            const scope = method.getScope();
+            if (scope === "private" || scope === "protected")
+              continue;
+            if (LIFECYCLE_HOOKS.has(methodName))
+              continue;
+            if (isNestJS && method.getDecorators().some((d) => NESTJS_METHOD_DECORATORS.has(d.getName())))
+              continue;
+            const callPattern = new RegExp(`\\.${methodName}\\s*\\(`);
+            let hasExternalCall = false;
+            for (const [otherFilePath, otherText] of allFileTexts) {
+              if (otherFilePath === filePath)
+                continue;
+              if (callPattern.test(otherText)) {
+                hasExternalCall = true;
+                break;
+              }
+            }
+            if (!hasExternalCall) {
+              const ownText = allFileTexts.get(filePath) ?? "";
+              const matches = ownText.match(new RegExp(`\\.${methodName}\\s*\\(`, "g"));
+              const internalCallCount = matches?.length ?? 0;
+              if (internalCallCount === 0) {
+                violations.push({
+                  category: "maintainability",
+                  type: "unused-public-method",
+                  ruleId: "unused-public-method",
+                  severity: "warning",
+                  source: "deterministic",
+                  confidence: "medium",
+                  file: filePath,
+                  line: method.getStartLineNumber(),
+                  function: methodName,
+                  message: `Public method '${methodName}' in ${className} has no call sites \u2014 consider removing it or marking it private`,
+                  suggestion: `Remove the unused method or mark it as private if it's only used internally`,
+                  debtPoints: 1,
+                  gateAction: "warn"
+                });
+              }
+            }
+          }
+        }
+      }
+      return violations;
+    }
     function emptyResult() {
       return {
         unusedExports: [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "technical-debt-radar",
-  "version": "1.6.4",
+  "version": "1.7.0",
   "description": "Stop Node.js production crashes before merge. 47 detection patterns across 5 categories.",
   "bin": {
     "radar": "dist/index.js",