stabilize imports

Author: ngmachado

src/ast/type_resolver/core/expression.zig

@@ -1026,7 +1026,10 @@ fn synthCall(
             if (self.module_exports) |me| {
                 const base = fa.target.Identifier.name;
                 if (me.isModuleAlias(base)) {
-                    if (me.lookupExport(base, fa.field)) |_| {
+                    if (me.lookupExport(base, fa.field)) |kind| {
+                        if (kind != .Function) {
+                            return TypeResolutionError.TypeMismatch;
+                        }
                         if (self.function_registry) |registry| {
                             const reg_map = @as(*std.StringHashMap(*FunctionNode), @ptrCast(@alignCast(registry)));
                             if (reg_map.get(fa.field)) |function| {
@@ -1315,9 +1318,10 @@ fn synthFieldAccess(
         if (fa.target.* == .Identifier) {
             const base = fa.target.Identifier.name;
             if (me.isModuleAlias(base)) {
-                if (me.lookupExport(base, fa.field)) |kind| {
-                    const result_type = switch (kind) {
+                if (me.lookupExportInfo(base, fa.field)) |export_info| {
+                    const result_type = switch (export_info.kind) {
                         .Function => blk: {
+                            if (export_info.type_info) |ti| break :blk ti;
                             if (self.function_registry) |registry| {
                                 const reg_map = @as(*std.StringHashMap(*FunctionNode), @ptrCast(@alignCast(registry)));
                                 if (reg_map.get(fa.field)) |function| {
@@ -1326,8 +1330,32 @@ fn synthFieldAccess(
                             }
                             break :blk TypeInfo.unknown();
                         },
-                        .Contract, .StructDecl, .EnumDecl, .BitfieldDecl => TypeInfo.unknown(),
-                        .Constant, .Variable => TypeInfo.unknown(),
+                        .Constant, .Variable => blk: {
+                            if (export_info.type_info) |ti| break :blk ti;
+
+                            // Fallback: resolved constant types are written back to symbols.
+                            const root_scope: ?*const Scope = @as(?*const Scope, @ptrCast(self.symbol_table.root));
+                            if (SymbolTable.findUp(root_scope, fa.field)) |sym| {
+                                if (sym.typ) |ti| break :blk ti;
+                            }
+                            break :blk TypeInfo.unknown();
+                        },
+                        .StructDecl => if (export_info.type_info) |ti|
+                            ti
+                        else
+                            TypeInfo.fromOraType(.{ .struct_type = fa.field }),
+                        .BitfieldDecl => if (export_info.type_info) |ti|
+                            ti
+                        else
+                            TypeInfo.fromOraType(.{ .bitfield_type = fa.field }),
+                        .EnumDecl => if (export_info.type_info) |ti|
+                            ti
+                        else
+                            TypeInfo.fromOraType(.{ .enum_type = fa.field }),
+                        .Contract => if (export_info.type_info) |ti|
+                            ti
+                        else
+                            TypeInfo.fromOraType(.{ .contract_type = fa.field }),
                         .LogDecl, .ErrorDecl => TypeInfo.unknown(),
                     };
                     fa.type_info = result_type;

src/imports/mod.test.zig

@@ -117,6 +117,35 @@ test "imports: relative specifier must include .ora extension" {
     );
 }
 
+test "imports: relative import cannot escape workspace root" {
+    const allocator = testing.allocator;
+    var tmp = testing.tmpDir(.{});
+    defer tmp.cleanup();
+
+    try tmp.dir.makePath("project/contracts");
+    try tmp.dir.makePath("outside");
+
+    try tmp.dir.writeFile(.{
+        .sub_path = "outside/secret.ora",
+        .data = "contract Secret { }",
+    });
+    try tmp.dir.writeFile(.{
+        .sub_path = "project/contracts/entry.ora",
+        .data = "const secret = @import(\"../../outside/secret.ora\");",
+    });
+
+    const entry_path = try pathFromTmpAlloc(allocator, tmp, "project/contracts/entry.ora");
+    defer allocator.free(entry_path);
+    const workspace_root = try pathFromTmpAlloc(allocator, tmp, "project");
+    defer allocator.free(workspace_root);
+
+    const roots = [_][]const u8{workspace_root};
+    try testing.expectError(
+        error.RelativeImportOutsideAllowedRoots,
+        imports.validateNormalImportsWithOptions(allocator, entry_path, .{ .workspace_roots = roots[0..] }),
+    );
+}
+
 test "imports: package style resolves from workspace roots" {
     const allocator = testing.allocator;
     var tmp = testing.tmpDir(.{});

src/imports/mod.zig

@@ -24,6 +24,7 @@ pub const ImportValidationError = error{
     ImportAliasRequired,
     DuplicateImportAlias,
     RelativeImportMustIncludeOraExtension,
+    RelativeImportOutsideAllowedRoots,
     InvalidImportSpecifier,
     PackageRootConflict,
     ParseFailed,
@@ -279,7 +280,6 @@ const Resolver = struct {
         };
 
         const canonical_id = std.fmt.allocPrint(self.allocator, "file:{s}", .{resolved_path}) catch {
-            self.allocator.free(resolved_path);
             return ImportValidationError.OutOfMemory;
         };
 
@@ -325,6 +325,7 @@ const Resolver = struct {
         }
 
         try self.states.put(record.canonical_id, .visiting);
+        errdefer _ = self.states.remove(record.canonical_id);
         try self.stack.append(self.allocator, record.canonical_id);
         defer _ = self.stack.pop();
 
@@ -407,6 +408,16 @@ const Resolver = struct {
             std.log.warn("Import target not found: '{s}' in module '{s}' ({s})", .{ specifier, importer.resolved_path, @errorName(err) });
             return ImportValidationError.ImportTargetNotFound;
         };
+        errdefer self.allocator.free(resolved_path);
+
+        if (!try self.isAllowedRelativePath(resolved_path)) {
+            std.log.warn("Relative import escapes allowed roots: '{s}' resolved to '{s}' from '{s}'", .{
+                specifier,
+                resolved_path,
+                importer.resolved_path,
+            });
+            return ImportValidationError.RelativeImportOutsideAllowedRoots;
+        }
 
         const canonical_id = std.fmt.allocPrint(self.allocator, "file:{s}", .{resolved_path}) catch {
             self.allocator.free(resolved_path);
@@ -420,6 +431,42 @@ const Resolver = struct {
         };
     }
 
+    fn isPathWithinRoot(path: []const u8, root: []const u8) bool {
+        if (!std.mem.startsWith(u8, path, root)) return false;
+        if (path.len == root.len) return true;
+        if (root.len == 0) return false;
+        if (root[root.len - 1] == std.fs.path.sep) return true;
+        return path[root.len] == std.fs.path.sep;
+    }
+
+    fn isAllowedRelativePath(self: *Resolver, resolved_path: []const u8) ImportValidationError!bool {
+        if (self.options.workspace_roots.len == 0 and self.options.include_roots.len == 0) {
+            const cwd_root = std.fs.cwd().realpathAlloc(self.allocator, ".") catch {
+                return ImportValidationError.OutOfMemory;
+            };
+            defer self.allocator.free(cwd_root);
+            return isPathWithinRoot(resolved_path, cwd_root);
+        }
+
+        for (self.options.workspace_roots) |root| {
+            const real_root = std.fs.cwd().realpathAlloc(self.allocator, root) catch {
+                continue;
+            };
+            defer self.allocator.free(real_root);
+            if (isPathWithinRoot(resolved_path, real_root)) return true;
+        }
+
+        for (self.options.include_roots) |root| {
+            const real_root = std.fs.cwd().realpathAlloc(self.allocator, root) catch {
+                continue;
+            };
+            defer self.allocator.free(real_root);
+            if (isPathWithinRoot(resolved_path, real_root)) return true;
+        }
+
+        return false;
+    }
+
     fn parsePackageSpecifier(specifier: []const u8) ImportValidationError!PackageSpecifier {
         const slash_index = std.mem.indexOfScalar(u8, specifier, '/') orelse return ImportValidationError.InvalidImportSpecifier;
         if (slash_index == 0 or slash_index + 1 >= specifier.len) {