TREK/sonar-project.properties

sonar.projectKey=liketrek_TREK
sonar.organization=liketrek
sonar.projectName=TREK
sonar.sourceEncoding=UTF-8

# Sources — one entry per workspace package (plugin-sdk is standalone but lives in-repo)
sonar.sources=client/src,server/src,shared/src,plugin-sdk/src

# Tests — dedicated test dirs per package, plus co-located client tests in src
# and co-located shared schema/sanitize/i18n specs in shared/src
sonar.tests=server/tests,client/tests,client/e2e,client/src,shared/src,plugin-sdk/test
sonar.test.inclusions=\
   server/tests/**/*.test.ts,\
   client/tests/**/*.test.ts,\
   client/tests/**/*.test.tsx,\
   client/e2e/**/*.spec.ts,\
   client/src/**/*.test.ts,\
   client/src/**/*.test.tsx,\
   shared/src/**/*.spec.ts,\
   plugin-sdk/test/**/*.test.ts

# Keep generated output and test files out of source analysis
sonar.exclusions=\
   **/node_modules/**,\
   **/dist/**,\
   **/build/**,\
   **/coverage/**,\
   client/dev-dist/**,\
   **/*.test.ts,\
   **/*.test.tsx,\
   **/*.spec.ts,\
   **/*.d.ts

# Coverage — lcov paths relative to repo root, one per package
# (each package's vitest config emits lcov to <pkg>/coverage/).
sonar.javascript.lcov.reportPaths=\
   server/coverage/lcov.info,\
   client/coverage/lcov.info,\
   shared/coverage/lcov.info,\
   plugin-sdk/coverage/lcov.info

# Infrastructure/bootstrap files plus generated/data files the vitest configs
# exclude from instrumentation (a file absent from lcov would otherwise count
# as 0% covered here — keep these in sync with each package's vitest.config.ts)
sonar.coverage.exclusions=\
   server/src/index.ts,\
   server/src/config.ts,\
   server/src/db/database.ts,\
   server/src/db/migrations.ts,\
   server/src/db/seeds.ts,\
   server/src/demo/**,\
   server/src/nest/plugins/runtime/plugin-host-entry.ts,\
   server/assets/**,\
   client/src/main.tsx,\
   client/src/types.ts,\
   shared/src/plugin-permissions.ts,\
   shared/src/i18n/*/**,\
   plugin-sdk/src/generated/**,\
   plugin-sdk/src/lucide-icon-names.ts

# Locale files are large near-identical literal objects — keep them out of duplication metrics
sonar.cpd.exclusions=shared/src/i18n/**


# Only categorical, path-wide suppressions live here — cases where the rule can
# never meaningfully apply to anything in the path. Instance-specific findings
# (a handful of flagged lines in one file) are resolved as false positive /
# accepted / reviewed-safe on SonarCloud instead, so a future violation of the
# same rule in the same file still surfaces.
sonar.issue.ignore.multicriteria=i18nsec1,i18nsec2,i18nsec3,rand1,rand2,path1,empty2


# Locale files are UI copy — strings like "Password", "API key", "token" are
# labels, not credentials, and the secret detectors false-positive on them
# constantly. Ignore the secrets analyzer and the hard-coded-credential rules on
# the locale directories only (shared/src/i18n/*/** — the top-level code files
# such as languages.ts stay fully scanned).

sonar.issue.ignore.multicriteria.i18nsec1.ruleKey=secrets:*
sonar.issue.ignore.multicriteria.i18nsec1.resourceKey=shared/src/i18n/*/**
sonar.issue.ignore.multicriteria.i18nsec2.ruleKey=typescript:S2068
sonar.issue.ignore.multicriteria.i18nsec2.resourceKey=shared/src/i18n/*/**
sonar.issue.ignore.multicriteria.i18nsec3.ruleKey=typescript:S6418
sonar.issue.ignore.multicriteria.i18nsec3.resourceKey=shared/src/i18n/*/**


# S2245 (Math.random in a security context) — Studio + studioStore only: minting
# element and spread ids with Math.random is pervasive by design there (uid()
# helpers across the whole component tree), so per-instance marks would recur on
# every refactor. The ids live inside the photo-book document, stored and
# fetched as one blob scoped by journey id — the server never indexes, looks up
# or authorizes on an element or spread id. Worst case of a collision is
# documented in studioStore itself: two elements would share a selection.

sonar.issue.ignore.multicriteria.rand1.ruleKey=typescript:S2245
sonar.issue.ignore.multicriteria.rand1.resourceKey=client/src/components/Studio/**
sonar.issue.ignore.multicriteria.rand2.ruleKey=typescript:S2245
sonar.issue.ignore.multicriteria.rand2.resourceKey=client/src/store/studioStore.ts


# S4036 (OS command via PATH) — the plugin SDK is a CLI a plugin author runs on
# their own machine, and reaching git/gh/npm through the developer's own PATH is
# the point of it. Every child-process invocation passes an argv array with no
# shell, so nothing is shell-parsed. The one server-side site was NOT
# suppressed: it resolves its binary to an absolute path before spawning
# (see server/src/nest/booking-import/kitinerary-extractor.service.ts).

sonar.issue.ignore.multicriteria.path1.ruleKey=typescript:S4036
sonar.issue.ignore.multicriteria.path1.resourceKey=plugin-sdk/src/cli/**


# S4158 (empty collection accessed) — client/src/managed is a build-time seam:
# the arrays are empty in this repo and in every build of it, and an operator
# shipping extra screens replaces the file. Its header comment makes reading
# them unconditionally a rule, so the public build takes the same code path as
# a managed one.

sonar.issue.ignore.multicriteria.empty2.ruleKey=typescript:S4158
sonar.issue.ignore.multicriteria.empty2.resourceKey=client/src/managed/**