impuestospy/eslint.config.js

import js from '@eslint/js';
import react from 'eslint-plugin-react';
import reactHooks from 'eslint-plugin-react-hooks';
import globals from 'globals';
import tseslint from 'typescript-eslint';

export default tseslint.config(
  {
    ignores: ['**/dist/**', '**/.next/**', '**/node_modules/**', '**/coverage/**', '**/*.d.ts'],
  },

  js.configs.recommended,
  ...tseslint.configs.recommended,

  {
    rules: {
      // `any` is allowed only with a written reason, per the build constraints.
      '@typescript-eslint/no-explicit-any': 'error',
      '@typescript-eslint/no-unused-vars': [
        'error',
        { argsIgnorePattern: '^_', varsIgnorePattern: '^_' },
      ],
      '@typescript-eslint/consistent-type-imports': ['error', { fixStyle: 'inline-type-imports' }],
      eqeqeq: ['error', 'always'],
      'no-console': 'off',
    },
  },

  // Module boundaries, SPEC.md section 4.
  {
    files: ['packages/**/*.ts'],
    rules: {
      'no-restricted-imports': [
        'error',
        {
          patterns: [
            {
              group: ['**/apps/**', '@impuestos/api', '@impuestos/web'],
              message:
                'packages/* are pure and must not import from apps. Move the shared piece into a package.',
            },
          ],
        },
      ],
    },
  },

  {
    files: ['apps/api/src/**/*.ts'],
    languageOptions: { globals: globals.node },
    rules: {
      'no-restricted-imports': [
        'error',
        {
          patterns: [
            {
              // Only modules/pii may reach the pii tables. Everything else goes through
              // the functions that module exports, so PII access stays auditable.
              group: ['**/modules/pii/*', '!**/modules/pii/index'],
              message:
                'Import from modules/pii (its index) instead of reaching into the pii module.',
            },
          ],
        },
      ],
    },
  },
  {
    files: ['apps/api/src/modules/pii/**/*.ts', 'apps/api/src/db/**/*.ts'],
    rules: { 'no-restricted-imports': 'off' },
  },

  // The web app has no database access at all: it holds no DB dependency and may not
  // import one even transitively through a shared package.
  {
    files: ['apps/web/**/*.{ts,tsx}'],
    languageOptions: {
      globals: { ...globals.browser, ...globals.node },
      parserOptions: { ecmaFeatures: { jsx: true } },
    },
    plugins: { react, 'react-hooks': reactHooks },
    settings: { react: { version: 'detect' } },
    rules: {
      ...reactHooks.configs.recommended.rules,
      'no-restricted-imports': [
        'error',
        {
          paths: [
            { name: 'kysely', message: 'The web app never touches the database.' },
            { name: 'better-sqlite3', message: 'The web app never touches the database.' },
            { name: 'pg', message: 'The web app never touches the database.' },
            {
              name: 'better-auth',
              message: 'Auth server code lives in apps/api. Use better-auth/react here.',
            },
          ],
        },
      ],
      // Constraint 12: user facing copy comes from the catalogs, never inline.
      // Punctuation and separators are allowed so layout markup stays readable.
      'react/jsx-no-literals': [
        'error',
        {
          noStrings: true,
          allowedStrings: ['·', '/', '|', ':', ',', '.', '-', '+', '(', ')', '%', '✓'],
          ignoreProps: true,
        },
      ],
    },
  },

  // The service worker runs in its own global scope, not the window's.
  {
    files: ['apps/web/src/lib/service-worker.js'],
    languageOptions: { globals: globals.serviceworker },
  },

  // Plain Node scripts: no JSX, no browser globals.
  {
    files: ['**/scripts/**/*.mjs', '*.config.{js,mjs,ts}', '**/*.config.{js,mjs,ts}'],
    languageOptions: { globals: globals.node },
  },

  // Tests assert on real copy, so literals are the point there.
  {
    files: ['**/*.test.ts', '**/*.test.tsx', 'e2e/**/*.ts'],
    rules: { 'react/jsx-no-literals': 'off' },
  },
);