fix(audits): follow exported non-verb helpers when resolving raw-route contracts

Author: waleedlatif1

scripts/check-route-verbs.test.ts

@@ -65,6 +65,12 @@ export const PUT = withRouteHandler((request, context) => PATCH(request, context
 })
 
 describe('export-list verbs on raw routes', () => {
+  it('follows an exported non-verb helper that parses the contract', () => {
+    const source = `import { updateContract } from '@/lib/api/contracts/things'
+export async function parseUpdate(request) { return parseRequest(updateContract, request) }
+export const PUT = withRouteHandler((request) => parseUpdate(request))`
+    expect(rawRouteContractSites(source)).toEqual([{ verb: 'PUT', identifier: 'updateContract' }])
+  })
   it('checks a handler exported as \`export { GET }\`', () => {
     const source = `const GET = withRouteHandler((request) => parseRequest(listContract, request, {}))
 export { GET }`

scripts/check-route-verbs.ts

@@ -229,12 +229,14 @@ export function rawRouteContractSites(source: string): Array<{ verb: string; ide
   const statements = parse(source, { sourceType: 'module', plugins: ['typescript'] }).program.body
   const { locals, exports } = topLevelBindings(statements)
   const parsers = parseRequestNames(statements)
-  const exportedLocals = new Set(exports.map(({ local }) => local))
+  const verbLocals = new Set(
+    exports.filter(({ exported }) => isVerb(exported)).map(({ local }) => local)
+  )
   const sites: Array<{ verb: string; identifier: string }> = []
   for (const { exported: verb, local } of exports) {
     if (!isVerb(verb)) continue
     const identifiers = new Set<string>()
-    const followed = new Set(exportedLocals)
+    const followed = new Set(verbLocals)
     const visit = (value: unknown): void => {
       if (!value || typeof value !== 'object') return
       if (Array.isArray(value)) {