analyzers

type EntityDecl struct {
	Name  string
	Group string
	File  string
	Line  int
	Pos   token.Pos
}

type EntityInfo struct {
	Name   string
	Fields []string
	// FieldsResolved is false when Fields came from a helper call rather
	// than a literal slice. The scoping rules stay quiet in that case:
	// they cannot see the columns, and guessing would mean either false
	// findings or a false all-clear.
	FieldsResolved bool

	CRUDDisabled bool
	MCP          bool
	Public       bool
	HasAccess    bool
	OwnerField   string
	MultiTenant  bool
	// AccessPermissions are the permission strings the entity's Access
	// block names. These are the permissions least likely to be exercised
	// by accident: nothing in the app calls them by name, so only a real
	// request through the CRUD layer can prove them.
	AccessPermissions []string

	File string
	Line int
	Pos  token.Pos
}

type EventSub struct {
	// Type is the event type string the handler listens for.
	Type string
	File string
	Line int
	Pos  token.Pos
}

type HookDecl struct {
	// Entity is the entity name the hook is attached to.
	Entity string
	// Type is the lifecycle point, lower-cased to match the manifest
	// ("beforecreate", "afterupdate", …).
	Type string
	File string
	Line int
	Pos  token.Pos
}

type RoleGrant struct {
	// Role is the role name granted permissions.
	Role string
	File string
	Line int
	Pos  token.Pos
}

type Route struct {
	// Method is the HTTP verb exactly as written, case included, since a
	// lowercase one is a finding rather than something to normalise away.
	Method string
	// Pattern is the full path with any resolvable group prefix applied.
	Pattern string
	// RawPattern is the literal passed at the call site, before prefixing.
	RawPattern string
	// Group is the receiver identifier, "" for a direct router call.
	Group string
	// Guarded is true when the route was registered on a group carrying
	// access or middleware, which is the framework's guarding seam.
	Guarded bool
	// Handler is the handler expression, for evidence.
	Handler string
	// Screen marks a route declared through `app.NewScreen`. Screens are
	// matched by core-ui's own router, NOT by ServeMux, and that router
	// takes `:id` parameters natively. It even rewrites `{id}` into
	// `:id`. Every rule about ServeMux pattern syntax must therefore skip
	// them, or it reports the correct spelling as a bug.
	Screen bool
	// Package is the import path of the registering package. Duplicate
	// detection is scoped by it: two example apps in one repository both
	// serving "/healthz" are not a conflict, they are two programs.
	Package string

	File string
	Line int
	Col  int
	Pos  token.Pos
}

type RouteTable struct {
	Routes   []Route
	Entities []EntityDecl
	// Registered is true when at least one registration was found,
	// distinguishing "no routes" from "this project does not register
	// routes in a way the static pass can see". Analyzers stay quiet in
	// the second case rather than reporting an empty app.
	Registered bool
}