Wires the rate-limit primitive end-to-end through auth.signIn as the
canonical credential-stuffing defence example:
- manifest: rateLimit [ip 5/1m, account 10/1h] on signIn use case
- use case: rateLimit: IRateLimit dep; dual consume + TooManyRequestsError
- binders: ctx.rateLimit ?? new NoopRateLimit() in bind-production + bind-dev-seed
- tRPC: TooManyRequestsError → TOO_MANY_REQUESTS error code in authProcedure
- tests: RecordingRateLimit dual-consume assertion; InMemoryRateLimit
budget-1 ip + account rejection; coverage 100% on use-cases layer
- ESLint: _manifest-ast.js extractRateLimitNames handles RateLimitBudget
objects ({name,window,budget}) in addition to plain string literals,
no-undeclared-rate-limit passes on both "ip" and "account" call sites
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
271 lines
7.9 KiB
JavaScript
271 lines
7.9 KiB
JavaScript
import fs from "node:fs";
|
|
import { parse } from "@typescript-eslint/parser";
|
|
|
|
function extractStringLiterals(arrayExpr) {
|
|
return arrayExpr.elements
|
|
.filter((el) => el && el.type === "Literal" && typeof el.value === "string")
|
|
.map((el) => el.value);
|
|
}
|
|
|
|
/**
|
|
* Extract budget names from a rateLimit array that contains either string
|
|
* literals ("ip") or RateLimitBudget objects ({ name: "ip", window: "1m", budget: 5 }).
|
|
*/
|
|
function extractRateLimitNames(arrayExpr) {
|
|
const names = [];
|
|
for (const el of arrayExpr.elements) {
|
|
if (!el) continue;
|
|
if (el.type === "Literal" && typeof el.value === "string") {
|
|
names.push(el.value);
|
|
} else if (el.type === "ObjectExpression") {
|
|
const nameProp = el.properties.find(
|
|
(p) =>
|
|
p.type === "Property" &&
|
|
p.key.type === "Identifier" &&
|
|
p.key.name === "name" &&
|
|
p.value.type === "Literal" &&
|
|
typeof p.value.value === "string",
|
|
);
|
|
if (nameProp) names.push(nameProp.value.value);
|
|
}
|
|
}
|
|
return names;
|
|
}
|
|
|
|
/**
|
|
* Parse a feature.manifest.ts file and extract per-use-case attributes.
|
|
* Walks the AST to find the `defineFeature({...} as const)` call expression
|
|
* and reads literal values from its argument object.
|
|
*
|
|
* Returns: { [useCaseName]: { mutates, audits[], publishes[], consumes[] } }
|
|
* Returns null if the file is missing or doesn't match the expected shape.
|
|
*/
|
|
export function parseManifestUseCases(manifestPath) {
|
|
let src;
|
|
try {
|
|
src = fs.readFileSync(manifestPath, "utf8");
|
|
} catch {
|
|
return null;
|
|
}
|
|
let ast;
|
|
try {
|
|
ast = parse(src, {
|
|
sourceType: "module",
|
|
ecmaVersion: "latest",
|
|
loc: false,
|
|
range: false,
|
|
});
|
|
} catch {
|
|
return null;
|
|
}
|
|
const defineCall = findDefineFeatureCall(ast);
|
|
if (!defineCall) return null;
|
|
const arg = unwrapAsConst(defineCall.arguments[0]);
|
|
if (!arg || arg.type !== "ObjectExpression") return null;
|
|
const useCasesProp = arg.properties.find(
|
|
(p) =>
|
|
p.type === "Property" &&
|
|
p.key.type === "Identifier" &&
|
|
p.key.name === "useCases",
|
|
);
|
|
if (!useCasesProp || useCasesProp.value.type !== "ObjectExpression")
|
|
return {};
|
|
const result = {};
|
|
for (const entry of useCasesProp.value.properties) {
|
|
if (entry.type !== "Property" || entry.value.type !== "ObjectExpression")
|
|
continue;
|
|
const name =
|
|
entry.key.type === "Identifier" ? entry.key.name : entry.key.value;
|
|
result[name] = extractUseCaseEntry(entry.value);
|
|
}
|
|
return result;
|
|
}
|
|
|
|
function findDefineFeatureCall(ast) {
|
|
for (const node of ast.body) {
|
|
if (node.type !== "ExportNamedDeclaration" || !node.declaration) continue;
|
|
if (node.declaration.type !== "VariableDeclaration") continue;
|
|
for (const decl of node.declaration.declarations) {
|
|
const init = decl.init;
|
|
if (!init) continue;
|
|
if (
|
|
init.type === "CallExpression" &&
|
|
init.callee.type === "Identifier" &&
|
|
init.callee.name === "defineFeature"
|
|
) {
|
|
return init;
|
|
}
|
|
}
|
|
}
|
|
return null;
|
|
}
|
|
|
|
function unwrapAsConst(node) {
|
|
if (node && node.type === "TSAsExpression") return node.expression;
|
|
return node;
|
|
}
|
|
|
|
function extractUseCaseEntry(objExpr) {
|
|
const entry = {
|
|
mutates: false,
|
|
audits: [],
|
|
publishes: [],
|
|
consumes: [],
|
|
analyticsEvents: [],
|
|
rateLimit: [],
|
|
};
|
|
for (const prop of objExpr.properties) {
|
|
if (prop.type !== "Property" || prop.key.type !== "Identifier") continue;
|
|
const key = prop.key.name;
|
|
if (key === "mutates" && prop.value.type === "Literal") {
|
|
entry.mutates = prop.value.value === true;
|
|
} else if (
|
|
(key === "audits" ||
|
|
key === "publishes" ||
|
|
key === "consumes" ||
|
|
key === "analyticsEvents") &&
|
|
prop.value.type === "ArrayExpression"
|
|
) {
|
|
entry[key] = extractStringLiterals(prop.value);
|
|
} else if (key === "rateLimit" && prop.value.type === "ArrayExpression") {
|
|
entry[key] = extractRateLimitNames(prop.value);
|
|
}
|
|
}
|
|
return entry;
|
|
}
|
|
|
|
/**
|
|
* Parse a feature.manifest.ts and return the full manifest shape:
|
|
* { name, requiredCores: string[], useCases: { [name]: {...} } }
|
|
*
|
|
* Same AST walking as parseManifestUseCases but additionally extracts
|
|
* the top-level name + requiredCores fields. Returns null on parse failure.
|
|
*/
|
|
export function parseManifestFully(manifestPath) {
|
|
// Reuse the AST parser used by parseManifestUseCases by inlining the
|
|
// file-read + AST walk. We need access to the manifest's top-level
|
|
// argument object beyond just useCases.
|
|
let src;
|
|
try {
|
|
src = fs.readFileSync(manifestPath, "utf8");
|
|
} catch {
|
|
return null;
|
|
}
|
|
let ast;
|
|
try {
|
|
ast = parse(src, {
|
|
sourceType: "module",
|
|
ecmaVersion: "latest",
|
|
loc: false,
|
|
range: false,
|
|
});
|
|
} catch {
|
|
return null;
|
|
}
|
|
const defineCall = findDefineFeatureCallFromBody(ast);
|
|
if (!defineCall) return null;
|
|
const arg = unwrapAsConstNode(defineCall.arguments[0]);
|
|
if (!arg || arg.type !== "ObjectExpression") return null;
|
|
|
|
let name = null;
|
|
let requiredCores = [];
|
|
let requiresConsent = [];
|
|
let useCases = {};
|
|
|
|
for (const prop of arg.properties) {
|
|
if (prop.type !== "Property" || prop.key.type !== "Identifier") continue;
|
|
if (
|
|
prop.key.name === "name" &&
|
|
prop.value.type === "Literal" &&
|
|
typeof prop.value.value === "string"
|
|
) {
|
|
name = prop.value.value;
|
|
} else if (
|
|
prop.key.name === "requiredCores" &&
|
|
prop.value.type === "ArrayExpression"
|
|
) {
|
|
requiredCores = extractStringLiterals(prop.value);
|
|
} else if (
|
|
prop.key.name === "requiresConsent" &&
|
|
prop.value.type === "ArrayExpression"
|
|
) {
|
|
requiresConsent = extractStringLiterals(prop.value);
|
|
} else if (
|
|
prop.key.name === "useCases" &&
|
|
prop.value.type === "ObjectExpression"
|
|
) {
|
|
useCases = extractUseCasesMap(prop.value);
|
|
}
|
|
}
|
|
|
|
if (name === null) return null;
|
|
return { name, requiredCores, requiresConsent, useCases };
|
|
}
|
|
|
|
function extractUseCasesMap(useCasesObjExpr) {
|
|
const result = {};
|
|
for (const entry of useCasesObjExpr.properties) {
|
|
if (entry.type !== "Property" || entry.value.type !== "ObjectExpression")
|
|
continue;
|
|
const ucName =
|
|
entry.key.type === "Identifier" ? entry.key.name : entry.key.value;
|
|
result[ucName] = extractUseCaseEntryFromObj(entry.value);
|
|
}
|
|
return result;
|
|
}
|
|
|
|
// Helper aliases for the existing private functions — exposed under
|
|
// different names to avoid touching existing code paths.
|
|
function findDefineFeatureCallFromBody(ast) {
|
|
for (const node of ast.body) {
|
|
if (node.type !== "ExportNamedDeclaration" || !node.declaration) continue;
|
|
if (node.declaration.type !== "VariableDeclaration") continue;
|
|
for (const decl of node.declaration.declarations) {
|
|
const init = decl.init;
|
|
if (!init) continue;
|
|
if (
|
|
init.type === "CallExpression" &&
|
|
init.callee.type === "Identifier" &&
|
|
init.callee.name === "defineFeature"
|
|
) {
|
|
return init;
|
|
}
|
|
}
|
|
}
|
|
return null;
|
|
}
|
|
|
|
function unwrapAsConstNode(node) {
|
|
if (node && node.type === "TSAsExpression") return node.expression;
|
|
return node;
|
|
}
|
|
|
|
function extractUseCaseEntryFromObj(objExpr) {
|
|
const entry = {
|
|
mutates: false,
|
|
audits: [],
|
|
publishes: [],
|
|
consumes: [],
|
|
analyticsEvents: [],
|
|
rateLimit: [],
|
|
};
|
|
for (const prop of objExpr.properties) {
|
|
if (prop.type !== "Property" || prop.key.type !== "Identifier") continue;
|
|
const key = prop.key.name;
|
|
if (key === "mutates" && prop.value.type === "Literal") {
|
|
entry.mutates = prop.value.value === true;
|
|
} else if (
|
|
(key === "audits" ||
|
|
key === "publishes" ||
|
|
key === "consumes" ||
|
|
key === "analyticsEvents") &&
|
|
prop.value.type === "ArrayExpression"
|
|
) {
|
|
entry[key] = extractStringLiterals(prop.value);
|
|
} else if (key === "rateLimit" && prop.value.type === "ArrayExpression") {
|
|
entry[key] = extractRateLimitNames(prop.value);
|
|
}
|
|
}
|
|
return entry;
|
|
}
|