dte-rails-toolkit

Deterministic websocket / Turbo-Stream HARDENING checker for any ActionCable or Turbo Streams Rails app — flags the security failures that produce no error: a channel that streams without authorizing the subscriber (broadcast eavesdropping), `constantize`/`safe_constantize` on a client-supplied params/data string (arbitrary class load / RCE-ish), Action Cable request-forgery protection disabled in a non-dev env (CSWSH), and — as caveated heuristics — a missing `allowed_request_origins` allowlist or a CSP with no `connect-src`. Stack-agnostic (NOT tied to StimulusReflex). Use as a cheap pre-pass before a security review, when auditing websocket code, or to gate these in CI. Emits file:line + the rule + the fix.

Fast, deterministic, no-LLM static checker for the three CSV import footguns that produce NO error in review but bite in production — loading a whole CSV into memory instead of streaming (CSV.read / CSV.parse(File.read) on an import path), missing encoding/BOM handling on file ingest (mojibake, or a BOM that nulls the first header), and create!/save!/update! inside a CSV row loop with no transaction and no per-row error reporting (first bad row aborts the import, no idea which row failed). Scans only import/upload-reachable code (controllers, jobs, services, interactors, models, lib). Use when adding a CI gate for a CSV import feature, or reviewing one for memory blow-up and silent/all-or-nothing imports. This is a CHECKER, not a CSV-writer.

Fast, deterministic, no-LLM checker that asserts a Rails app's N+1 DEFENSES exist (strict_loading config, or a prosopite/bullet/n_plus_one_control gem + test gate) and flags two narrow, high-confidence N+1 anti-patterns — `.count` on an association in a view or loop (a COUNT query per row; use counter_cache + `.size`), and a relation-breaker (`.order`/`.where`/`.pluck`) chained on an association inside a loop (the "includes-ignored" trap that silently defeats an eager-load). This is NOT a general static N+1 detector — Bullet/Prosopite/strict_loading do that at runtime; a grep-based detector is strictly worse. Use as a CI gate or a cheap pre-pass before the runtime gems / dte-perf, to catch the failure-with-no-error (works, tests green, just slow) at rest. Emits file:line + rule + fix.

Deterministically flag layer-boundary violations from palkan's "Layered Design for Rails" — the failures that produce no runtime error but leak request-global state, push queries into the wrong layer, or hide I/O in model callbacks. Use as a cheap, reproducible PRE-PASS before an architectural review, when auditing a Rails app for layering smells, or in CI to gate Current-attributes misuse, request leaks into the domain layer, query-building in controllers/views, and I/O in after_* callbacks. Emits file:line + the rule that fired.

Fast, deterministic, no-LLM static checker that flags test smells which make a Rails test suite flaky, slow, or unable to catch a real bug — `sleep` in feature/system tests, missing WebMock/VCR guard, stubbing the system under test, boolean predicates inside assertions, Mystery Guest setup, and tautological assertions. Reads BOTH Minitest (test/**/*_test.rb) and RSpec (spec/**/*_spec.rb). Use when adding a CI test-quality gate, reviewing a test suite for flakiness/false-greens, or pre-filtering before the dte-test-auditor LLM judge. This is a CHECKER, not a test-writer.