sonar-project.properties

sonar.projectKey=formbricks_formbricks
sonar.organization=formbricks

# Sources
# ENG-2432: every workspace that ships runtime code and produces `coverage/lcov.info` under
# `pnpm test:coverage` is in scope. `ai`, `database`, `email`, `i18n-utils`, `jobs`, `logger`,
# `types` and `workflows` had the coverage scripts but were never listed here, so they were analysed
# by nothing and counted toward no gate. `sources`, `tests`, `javascript.lcov.reportPaths` and
# `typescript.tsconfigPath` must be extended together — a package listed in `sources` without its
# lcov report reads as 0% covered. Still out of scope: `config-eslint`, `config-prettier` and
# `config-typescript` (config files only), and `vite-plugins` (build tooling — one test, and its
# vitest config emits clover rather than lcov, so enrolling it means a reporter change first).
sonar.sources=apps/web,packages/surveys,packages/survey-ui,packages/js-core,packages/cache,packages/storage,packages/ai,packages/database,packages/email,packages/i18n-utils,packages/jobs,packages/logger,packages/types,packages/workflows
# `**/.env` is a generated file, not source. `apps/web/.env` is a tracked SYMLINK to the repo-root
# `.env` (which is gitignored) so that Next.js picks the root file up, and CI runs `pnpm dev:setup`
# before scanning — which writes that file from `.env.example` and fills every secret with a fresh
# `openssl rand -hex 32` (scripts/setup-dev-env.sh). Sonar then followed the symlink and reported
# those throwaway runner-local values as hardcoded credentials. Nothing is committed: the template
# ships the keys empty. `.env.example` itself stays in scope, so a real secret added there is still
# caught.
# Putting `packages/database` in `sources` also offers Sonar the 175 committed Prisma migration
# `.sql` files, which its PL/SQL sensor would index (176 files against 1 on main). That sensor parses
# Oracle PL/SQL, not Postgres DDL, and nothing here is code we write by hand or could act on — the
# files are generated by `prisma migrate` and are immutable once applied. Excluded from analysis
# rather than only from coverage, since the point is to keep the sensor off them entirely; the
# `migration.ts` siblings are a coverage exclusion below for a different reason. The PR gate would not
# have shown this either way, because the PL/SQL sensor only looks at changed files on a branch — it
# would first have landed on the post-merge scan of main.
sonar.exclusions=**/node_modules/**,**/.next/**,**/dist/**,**/build/**,**/*.test.*,**/*.spec.*,**/__mocks__/**,packages/survey-ui/**/*.stories.*,**/.env,packages/database/migration/**/*.sql

# Tests
sonar.tests=apps/web,packages/surveys,packages/survey-ui,packages/js-core,packages/cache,packages/storage,packages/ai,packages/database,packages/email,packages/i18n-utils,packages/jobs,packages/logger,packages/types,packages/workflows
sonar.test.inclusions=**/*.test.ts,**/*.spec.ts
sonar.javascript.lcov.reportPaths=apps/web/coverage/lcov.info,packages/surveys/coverage/lcov.info,packages/survey-ui/coverage/lcov.info,packages/js-core/coverage/lcov.info,packages/cache/coverage/lcov.info,packages/storage/coverage/lcov.info,packages/ai/coverage/lcov.info,packages/database/coverage/lcov.info,packages/email/coverage/lcov.info,packages/i18n-utils/coverage/lcov.info,packages/jobs/coverage/lcov.info,packages/logger/coverage/lcov.info,packages/types/coverage/lcov.info,packages/workflows/coverage/lcov.info

# TypeScript configuration
sonar.typescript.tsconfigPath=apps/web/tsconfig.json,packages/surveys/tsconfig.json,packages/survey-ui/tsconfig.json,packages/js-core/tsconfig.json,packages/cache/tsconfig.json,packages/storage/tsconfig.json,packages/ai/tsconfig.json,packages/database/tsconfig.json,packages/email/tsconfig.json,packages/i18n-utils/tsconfig.json,packages/jobs/tsconfig.json,packages/logger/tsconfig.json,packages/types/tsconfig.json,packages/workflows/tsconfig.json

# Issue exclusions
# ENG-2554: validate-webhook-url.ts is the SSRF denylist, so hardcoded IP ranges are its entire
# purpose — S1313 ("make sure using a hardcoded IP address is safe") is a false positive for every
# entry in it. The ranges were always hardcoded; they were previously written as regex literals,
# which the rule does not detect, so expressing them as real CIDRs is what surfaced them. Scoped to
# that one file so S1313 keeps protecting the rest of the codebase.
sonar.issue.ignore.multicriteria=e1
sonar.issue.ignore.multicriteria.e1.ruleKey=typescript:S1313
sonar.issue.ignore.multicriteria.e1.resourceKey=apps/web/lib/utils/validate-webhook-url.ts

# SCM
sonar.scm.provider=git
sonar.scm.exclusions.disabled=false

# Encoding of the source code
sonar.sourceEncoding=UTF-8

# Node.js memory limit for JS/TS analysis (in MB)
sonar.javascript.node.maxspace=8192

# Coverage
# ENG-2432: `**/route.ts`, `**/route.tsx` and `**/actions.ts` used to be excluded here and in
# apps/web/vite.config.mts, which left the API route handlers and server actions — where
# authorization and input validation live — as the only backend layer outside the gate. Both lists
# now include them; `**/*.tsx` still covers `route.tsx`. They stay in `sonar.cpd.exclusions` below:
# route handlers share a boilerplate shape by design, and duplication there is not a defect.
# `**/types/**` is narrowed to the three shapes it was written for (apps/web route/module `types/`
# folders, each package's `src/types/`, and `packages/database/types/`) because the glob also matched
# the whole `packages/types` workspace — which holds runtime code (the embedded-data resolver,
# `safe-identifier`, the response and survey validators) that is now in scope.
# ENG-1054: the Better Auth instance + wiring (auth.ts, auth-client.ts, the email-verification /
# SSO-recovery / SSO-deletion-request hooks) are exercised by the integration suite (real Postgres,
# `pnpm test:integration`), not by the unit run Sonar reads — mirror vite.config.mts's exclusions.
# Also drop the apps/web/integration test-harness sources and the one-time cutover migration scripts.
# `packages/database/migration/**/migration.ts` is excluded on the same grounds as that cutover
# directory: 27 run-once scripts executed against a real database by the migration runner, not app
# runtime. Their extracted `utils.ts` helpers are pure logic and stay in scope — that is where the
# decisions a migration makes are already tested.
sonar.coverage.exclusions=**/*.test.*,**/*.spec.*,**/*.tsx,**/*.mdx,**/*.config.mts,**/*.config.ts,**/constants.ts,apps/web/**/types/**,**/src/types/**,packages/database/types/**,**/types.ts,**/stories.*,**/*.mock.*,**/mocks/**,**/__mocks__/**,**/openapi.ts,**/openapi-document.ts,**/instrumentation.ts,scripts/openapi/merge-client-endpoints.ts,**/playwright/**,**/Dockerfile,**/*.config.cjs,**/*.css,**/templates.ts,apps/web/modules/ui/components/icons/*,**/*.json,apps/web/vitestSetup.ts,packages/js-core/src/index.ts,packages/surveys/src/index.ts,apps/web/postcss.config.js,apps/web/next.config.mjs,apps/web/scripts/**,packages/js-core/vitest.setup.ts,**/*.mjs,apps/web/modules/auth/lib/mock-data.ts,**/cache.ts,apps/web/app/**/billing-confirmation/**,apps/web/modules/ee/billing/**,apps/web/modules/survey/multi-language-surveys/**,apps/web/modules/email/**,apps/web/modules/integrations/**,apps/web/modules/setup/**/intro/**,apps/web/modules/setup/**/signup/**,apps/web/modules/setup/**/layout.tsx,apps/web/modules/survey/follow-ups/**,apps/web/app/share/**,apps/web/modules/ee/contacts/[contactId]/**,apps/web/modules/ee/contacts/components/**,apps/web/modules/ee/two-factor-auth/**,apps/web/lib/slack/**,apps/web/lib/notion/**,apps/web/lib/googleSheet/**,apps/web/app/api/google-sheet/**,apps/web/app/api/billing/**,apps/web/lib/airtable/**,apps/web/app/api/v1/integrations/**,apps/web/lib/env.ts,apps/web/lib/env-client.ts,**/instrumentation-node.ts,**/cache/**,**/*.svg,apps/web/modules/ui/components/icons/**,apps/web/modules/ui/components/table/**,packages/survey-ui/**/*.stories.*,apps/web/integration/**,apps/web/modules/auth/lib/auth.ts,apps/web/modules/auth/lib/auth-client.ts,apps/web/modules/auth/lib/cutover/**,packages/database/migration/**/migration.ts,apps/web/modules/auth/lib/better-auth-email-verification.ts,apps/web/modules/ee/sso/lib/better-auth-recovery-signin.ts,apps/web/modules/account/lib/better-auth-account-deletion-request.ts
# CPD exclusions.
#
# `reserved-field-display.ts` (ENG-2540) is an i18n dispatch table: a switch of literal `t("…")`
# calls, one arm per reserved field. It cannot be a name -> key lookup map, because
# packages/i18n-utils/src/scan-translations.ts only counts a key as used when it is a literal first
# argument to `t(` — a map makes every key read as dead and offers to delete it from all fifteen
# locale files. CPD normalises string literals away, so past roughly eleven arms such a switch
# matches itself shifted by two lines, and matches every other switch of the same shape (the
# segments `convertOperatorToText`/`convertOperatorToTitle` pair). There is nothing to factor out:
# the per-key literal is the whole content. Excluded rather than reshaped, because shaping the arm
# count to a token threshold would silently re-trip the next time a catalog entry is added.
# CPD: apps/web/lib/surveyLogic/utils.ts is the deliberate mirror of the survey runtime evaluator in
# packages/surveys/src/lib/logic.ts — every fix must land in both copies, so new-code duplication
# between them is expected until the evaluator is unified into a shared package.
# CPD: packages/i18n-utils/src/utils.ts is the `iso639Languages` catalog — one 20-line object literal
# per language, the same keys in the same order, only the label strings differing. CPD normalises the
# literals away, so every added entry duplicates its neighbour line for line; there is no logic to share.
sonar.cpd.exclusions=packages/i18n-utils/src/utils.ts,apps/web/modules/ee/analysis/lib/schema-definition.ts,apps/web/modules/analysis/lib/reserved-field-display.ts,apps/web/lib/surveyLogic/utils.ts,**/*.test.*,**/*.spec.*,**/*.tsx,**/*.mdx,**/*.config.mts,**/*.config.ts,**/constants.ts,**/route.ts,**/route.tsx,**/types/**,**/types.ts,**/stories.*,**/*.mock.*,**/mocks/**,**/__mocks__/**,**/openapi.ts,**/openapi-document.ts,**/instrumentation.ts,scripts/openapi/merge-client-endpoints.ts,**/playwright/**,**/Dockerfile,**/*.config.cjs,**/*.css,**/templates.ts,**/actions.ts,apps/web/modules/ui/components/icons/*,**/*.json,apps/web/vitestSetup.ts,apps/web/postcss.config.js,apps/web/next.config.mjs,apps/web/scripts/**,packages/js-core/vitest.setup.ts,packages/js-core/src/index.ts,**/*.mjs,apps/web/modules/auth/lib/mock-data.ts,**/cache.ts,apps/web/app/**/billing-confirmation/**,apps/web/modules/ee/billing/**,apps/web/modules/survey/multi-language-surveys/**,apps/web/modules/email/**,apps/web/modules/integrations/**,apps/web/modules/setup/**/intro/**,apps/web/modules/setup/**/signup/**,apps/web/modules/setup/**/layout.tsx,apps/web/modules/survey/follow-ups/**,apps/web/app/share/**,apps/web/modules/ee/contacts/[contactId]/**,apps/web/modules/ee/contacts/components/**,apps/web/modules/ee/two-factor-auth/**,apps/web/lib/slack/**,apps/web/lib/notion/**,apps/web/lib/googleSheet/**,apps/web/app/api/google-sheet/**,apps/web/app/api/billing/**,apps/web/lib/airtable/**,apps/web/app/api/v1/integrations/**,apps/web/lib/env.ts,**/instrumentation-node.ts,**/cache/**,**/*.svg,apps/web/modules/ui/components/icons/**,apps/web/modules/ui/components/table/**,packages/survey-ui/**/*.stories.*