fix(audits): classify the selected member of a local handler object

Author: waleedlatif1

scripts/check-source-conventions.test.ts

@@ -250,11 +250,20 @@ describe('bare-route-handler', () => {
       'const loop = () => other()',
       'const other = () => loop()',
       'const wrapped = withRouteHandler(handler)',
+      'const routes = { PATCH: async () => new Response(), HEAD() { return new Response() } }',
       'export const GET = alias',
       'export const PUT = loop',
+      'export const PATCH = routes.PATCH',
+      'export const HEAD = routes.HEAD',
       'export { handler as POST, wrapped as DELETE }',
     ].join('\n')
-    expect(hits(ROUTE, source, 'bare-route-handler')).toEqual(['GET', 'PUT', 'POST'])
+    expect(hits(ROUTE, source, 'bare-route-handler')).toEqual([
+      'GET',
+      'PUT',
+      'PATCH',
+      'HEAD',
+      'POST',
+    ])
   })
 
   it('allows wrapped results, their aliases and members, imports, and delegates to them', () => {
@@ -271,7 +280,14 @@ describe('bare-route-handler', () => {
       'export const OPTIONS = flag ? handler : handlers.OPTIONS',
       'export const dynamic = "force-dynamic"',
     ].join('\n')
+    const objectMembers = [
+      'const handler = defineInternalJsonRoute({ useCase })',
+      'const routes = { GET: withRouteHandler(async () => new Response()), PUT: handler }',
+      'export const GET = routes.GET',
+      'export const PUT = routes.PUT',
+    ].join('\n')
     expect(hits(ROUTE, source, 'bare-route-handler')).toEqual([])
+    expect(hits(ROUTE, objectMembers, 'bare-route-handler')).toEqual([])
   })
 
   it('only checks route files', () => {

scripts/check-source-conventions.ts

@@ -412,8 +412,12 @@ function classifyHandler(
           ? 'wrapped'
           : 'opaque'
     }
-    case 'MemberExpression':
-      return classifyHandler(node.object as Node, bindings, seen)
+    case 'MemberExpression': {
+      const member = objectLiteralMember(node, bindings)
+      if (member === undefined) return classifyHandler(node.object as Node, bindings, seen)
+      if (member.type === 'ObjectMethod') return 'bare'
+      return classifyHandler(member.value as Node, bindings, seen)
+    }
     case 'Identifier': {
       const name = node.name as string
       const binding = bindings.get(name)
@@ -427,6 +431,26 @@ function classifyHandler(
   }
 }
 
+/**
+ * The property `handlers.GET` selects when `handlers` is a local object literal, so the selected
+ * value is classified rather than the object. Undefined when the object is anything else.
+ */
+function objectLiteralMember(member: Node, bindings: Map<string, Node>): Node | undefined {
+  const object = unwrap(member.object as Node)
+  const property = member.property as Node
+  if (object?.type !== 'Identifier' || member.computed || property.type !== 'Identifier') {
+    return undefined
+  }
+  const binding = bindings.get(object.name as string)
+  const literal = binding?.type === 'VariableDeclarator' ? unwrap(binding.init as Node) : undefined
+  if (literal?.type !== 'ObjectExpression') return undefined
+  return (literal.properties as Node[]).find(
+    (entry) =>
+      (entry.type === 'ObjectProperty' || entry.type === 'ObjectMethod') &&
+      propertyKeyName(entry) === property.name
+  )
+}
+
 /** Whether an arrow's expression body calls through a local binding that is a wrapped handler. */
 function delegatesToWrapped(body: Node, bindings: Map<string, Node>, seen: Set<string>): boolean {
   let delegates = false