Files
agentic-dev/packages/core-eslint/rules/_manifest-ast.js
Danijel Martinek b61bb0c11e feat(auth): add signIn rate-limit backfill with dual ip/account budgets
Wires the rate-limit primitive end-to-end through auth.signIn as the
canonical credential-stuffing defence example:

- manifest: rateLimit [ip 5/1m, account 10/1h] on signIn use case
- use case: rateLimit: IRateLimit dep; dual consume + TooManyRequestsError
- binders: ctx.rateLimit ?? new NoopRateLimit() in bind-production + bind-dev-seed
- tRPC: TooManyRequestsError → TOO_MANY_REQUESTS error code in authProcedure
- tests: RecordingRateLimit dual-consume assertion; InMemoryRateLimit
  budget-1 ip + account rejection; coverage 100% on use-cases layer
- ESLint: _manifest-ast.js extractRateLimitNames handles RateLimitBudget
  objects ({name,window,budget}) in addition to plain string literals,
  no-undeclared-rate-limit passes on both "ip" and "account" call sites

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-20 09:22:41 +00:00

271 lines
7.9 KiB
JavaScript

import fs from "node:fs";
import { parse } from "@typescript-eslint/parser";
function extractStringLiterals(arrayExpr) {
return arrayExpr.elements
.filter((el) => el && el.type === "Literal" && typeof el.value === "string")
.map((el) => el.value);
}
/**
* Extract budget names from a rateLimit array that contains either string
* literals ("ip") or RateLimitBudget objects ({ name: "ip", window: "1m", budget: 5 }).
*/
function extractRateLimitNames(arrayExpr) {
const names = [];
for (const el of arrayExpr.elements) {
if (!el) continue;
if (el.type === "Literal" && typeof el.value === "string") {
names.push(el.value);
} else if (el.type === "ObjectExpression") {
const nameProp = el.properties.find(
(p) =>
p.type === "Property" &&
p.key.type === "Identifier" &&
p.key.name === "name" &&
p.value.type === "Literal" &&
typeof p.value.value === "string",
);
if (nameProp) names.push(nameProp.value.value);
}
}
return names;
}
/**
* Parse a feature.manifest.ts file and extract per-use-case attributes.
* Walks the AST to find the `defineFeature({...} as const)` call expression
* and reads literal values from its argument object.
*
* Returns: { [useCaseName]: { mutates, audits[], publishes[], consumes[] } }
* Returns null if the file is missing or doesn't match the expected shape.
*/
export function parseManifestUseCases(manifestPath) {
let src;
try {
src = fs.readFileSync(manifestPath, "utf8");
} catch {
return null;
}
let ast;
try {
ast = parse(src, {
sourceType: "module",
ecmaVersion: "latest",
loc: false,
range: false,
});
} catch {
return null;
}
const defineCall = findDefineFeatureCall(ast);
if (!defineCall) return null;
const arg = unwrapAsConst(defineCall.arguments[0]);
if (!arg || arg.type !== "ObjectExpression") return null;
const useCasesProp = arg.properties.find(
(p) =>
p.type === "Property" &&
p.key.type === "Identifier" &&
p.key.name === "useCases",
);
if (!useCasesProp || useCasesProp.value.type !== "ObjectExpression")
return {};
const result = {};
for (const entry of useCasesProp.value.properties) {
if (entry.type !== "Property" || entry.value.type !== "ObjectExpression")
continue;
const name =
entry.key.type === "Identifier" ? entry.key.name : entry.key.value;
result[name] = extractUseCaseEntry(entry.value);
}
return result;
}
function findDefineFeatureCall(ast) {
for (const node of ast.body) {
if (node.type !== "ExportNamedDeclaration" || !node.declaration) continue;
if (node.declaration.type !== "VariableDeclaration") continue;
for (const decl of node.declaration.declarations) {
const init = decl.init;
if (!init) continue;
if (
init.type === "CallExpression" &&
init.callee.type === "Identifier" &&
init.callee.name === "defineFeature"
) {
return init;
}
}
}
return null;
}
function unwrapAsConst(node) {
if (node && node.type === "TSAsExpression") return node.expression;
return node;
}
function extractUseCaseEntry(objExpr) {
const entry = {
mutates: false,
audits: [],
publishes: [],
consumes: [],
analyticsEvents: [],
rateLimit: [],
};
for (const prop of objExpr.properties) {
if (prop.type !== "Property" || prop.key.type !== "Identifier") continue;
const key = prop.key.name;
if (key === "mutates" && prop.value.type === "Literal") {
entry.mutates = prop.value.value === true;
} else if (
(key === "audits" ||
key === "publishes" ||
key === "consumes" ||
key === "analyticsEvents") &&
prop.value.type === "ArrayExpression"
) {
entry[key] = extractStringLiterals(prop.value);
} else if (key === "rateLimit" && prop.value.type === "ArrayExpression") {
entry[key] = extractRateLimitNames(prop.value);
}
}
return entry;
}
/**
* Parse a feature.manifest.ts and return the full manifest shape:
* { name, requiredCores: string[], useCases: { [name]: {...} } }
*
* Same AST walking as parseManifestUseCases but additionally extracts
* the top-level name + requiredCores fields. Returns null on parse failure.
*/
export function parseManifestFully(manifestPath) {
// Reuse the AST parser used by parseManifestUseCases by inlining the
// file-read + AST walk. We need access to the manifest's top-level
// argument object beyond just useCases.
let src;
try {
src = fs.readFileSync(manifestPath, "utf8");
} catch {
return null;
}
let ast;
try {
ast = parse(src, {
sourceType: "module",
ecmaVersion: "latest",
loc: false,
range: false,
});
} catch {
return null;
}
const defineCall = findDefineFeatureCallFromBody(ast);
if (!defineCall) return null;
const arg = unwrapAsConstNode(defineCall.arguments[0]);
if (!arg || arg.type !== "ObjectExpression") return null;
let name = null;
let requiredCores = [];
let requiresConsent = [];
let useCases = {};
for (const prop of arg.properties) {
if (prop.type !== "Property" || prop.key.type !== "Identifier") continue;
if (
prop.key.name === "name" &&
prop.value.type === "Literal" &&
typeof prop.value.value === "string"
) {
name = prop.value.value;
} else if (
prop.key.name === "requiredCores" &&
prop.value.type === "ArrayExpression"
) {
requiredCores = extractStringLiterals(prop.value);
} else if (
prop.key.name === "requiresConsent" &&
prop.value.type === "ArrayExpression"
) {
requiresConsent = extractStringLiterals(prop.value);
} else if (
prop.key.name === "useCases" &&
prop.value.type === "ObjectExpression"
) {
useCases = extractUseCasesMap(prop.value);
}
}
if (name === null) return null;
return { name, requiredCores, requiresConsent, useCases };
}
function extractUseCasesMap(useCasesObjExpr) {
const result = {};
for (const entry of useCasesObjExpr.properties) {
if (entry.type !== "Property" || entry.value.type !== "ObjectExpression")
continue;
const ucName =
entry.key.type === "Identifier" ? entry.key.name : entry.key.value;
result[ucName] = extractUseCaseEntryFromObj(entry.value);
}
return result;
}
// Helper aliases for the existing private functions — exposed under
// different names to avoid touching existing code paths.
function findDefineFeatureCallFromBody(ast) {
for (const node of ast.body) {
if (node.type !== "ExportNamedDeclaration" || !node.declaration) continue;
if (node.declaration.type !== "VariableDeclaration") continue;
for (const decl of node.declaration.declarations) {
const init = decl.init;
if (!init) continue;
if (
init.type === "CallExpression" &&
init.callee.type === "Identifier" &&
init.callee.name === "defineFeature"
) {
return init;
}
}
}
return null;
}
function unwrapAsConstNode(node) {
if (node && node.type === "TSAsExpression") return node.expression;
return node;
}
function extractUseCaseEntryFromObj(objExpr) {
const entry = {
mutates: false,
audits: [],
publishes: [],
consumes: [],
analyticsEvents: [],
rateLimit: [],
};
for (const prop of objExpr.properties) {
if (prop.type !== "Property" || prop.key.type !== "Identifier") continue;
const key = prop.key.name;
if (key === "mutates" && prop.value.type === "Literal") {
entry.mutates = prop.value.value === true;
} else if (
(key === "audits" ||
key === "publishes" ||
key === "consumes" ||
key === "analyticsEvents") &&
prop.value.type === "ArrayExpression"
) {
entry[key] = extractStringLiterals(prop.value);
} else if (key === "rateLimit" && prop.value.type === "ArrayExpression") {
entry[key] = extractRateLimitNames(prop.value);
}
}
return entry;
}