fix(audits): accept HEAD on a GET contract and treat empty import/export clauses as runtime edges

Author: waleedlatif1

scripts/check-monorepo-boundaries.test.ts

@@ -87,6 +87,8 @@ describe('package boundary command', () => {
         ["import * as contracts from '@/lib/api/contracts/widgets'", useCase, false],
         ["import { presentWidget } from '@/lib/api/server/widget-presenters'", useCase, false],
         ["import { run } from '@/lib/mothership/tools/handlers/run-code'", useCase, false],
+        ["import {} from '@/lib/mothership/tools/handlers/run-code'", useCase, false],
+        ["export {} from '@/lib/api/server/widget-presenters'", useCase, false],
         ["const tool = import('@/lib/mothership/tools/server/widgets')", useCase, false],
         ["import { listWidgetsContract } from '../../api/contracts/widgets'", useCase, false],
         ["import { GET } from '../../../app/api/widgets/route'", useCase, false],

scripts/check-monorepo-boundaries.ts

@@ -82,7 +82,7 @@ function applicationViolation(
 
 /**
  * Runtime (non-type) names an import/export declaration binds: `'all'` for a
- * namespace, default, star or side-effect edge, `[]` for one the compiler erases.
+ * namespace, default, star, empty-clause or side-effect edge, `[]` for one the compiler erases.
  */
 function runtimeBindings(node: ts.ImportDeclaration | ts.ExportDeclaration): string[] | 'all' {
   if (ts.isImportDeclaration(node)) {
@@ -92,14 +92,14 @@ function runtimeBindings(node: ts.ImportDeclaration | ts.ExportDeclaration): str
     if (clause.name) return 'all'
     const named = clause.namedBindings
     if (!named) return []
-    if (ts.isNamespaceImport(named)) return 'all'
+    if (ts.isNamespaceImport(named) || named.elements.length === 0) return 'all'
     return named.elements
       .filter((element) => !element.isTypeOnly)
       .map((element) => (element.propertyName ?? element.name).text)
   }
   if (node.isTypeOnly) return []
   const clause = node.exportClause
-  if (!clause || ts.isNamespaceExport(clause)) return 'all'
+  if (!clause || ts.isNamespaceExport(clause) || clause.elements.length === 0) return 'all'
   return clause.elements
     .filter((element) => !element.isTypeOnly)
     .map((element) => (element.propertyName ?? element.name).text)

scripts/check-route-verbs.test.ts

@@ -118,3 +118,23 @@ describe('aliased contract imports', () => {
     expect(failures[0]).toContain('which declares PATCH /api/things')
   })
 })
+
+describe('HEAD handlers', () => {
+  const route = {
+    relative: 'route.ts',
+    bindings: importedNames(`import { readContract } from '@/lib/api/contracts/things'`),
+    expectedPath: '/api/things',
+  }
+  const loadModule = () => Promise.resolve({ readContract: { method: 'GET', path: '/api/things' } })
+
+  it('accepts a HEAD handler on a GET contract, as methodMatchesContract does', async () => {
+    const failures: string[] = []
+    await checkSite(route, 'raw', 'HEAD', 'readContract', failures, false, loadModule)
+    expect(failures).toEqual([])
+  })
+  it('still rejects any other verb on a GET contract', async () => {
+    const failures: string[] = []
+    await checkSite(route, 'raw', 'POST', 'readContract', failures, false, loadModule)
+    expect(failures).toHaveLength(1)
+  })
+})

scripts/check-route-verbs.ts

@@ -429,7 +429,8 @@ export async function checkSite(
     kind === 'builder'
       ? `export const ${verb} is built from \`${identifier}\``
       : `export const ${verb} parses with \`${identifier}\``
-  if (contract.method.toUpperCase() !== verb) {
+  const method = contract.method.toUpperCase()
+  if (method !== verb && !(verb === 'HEAD' && method === 'GET')) {
     failures.push(
       kind === 'builder'
         ? `${relative}: ${subject}, which declares ${contract.method} ${contract.path}. Next routes by the exported symbol, so ${verb} requests 500 and ${contract.method} requests 404.`