Improve immutability of modeling store state

This improves the immutability of the modeling store state by using
TypeScript's readonly types to ensure that state can only be modified
from within the modeling store or when it's copied. This mostly consists
of adding `readonly` to properties and arrays, but this also adds a
`DeepReadonly` type to use in `postMessage` arguments to ensure that
readonly objects can be passed in. `postMessage` will never modify the
objects, so this is safe.

Author: koesie10

extensions/ql-vscode/src/common/readonly.ts

@@ -0,0 +1,14 @@
+export type DeepReadonly<T> = T extends Array<infer R>
+  ? DeepReadonlyArray<R>
+  : // eslint-disable-next-line @typescript-eslint/ban-types
+  T extends Function
+  ? T
+  : T extends object
+  ? DeepReadonlyObject<T>
+  : T;
+
+interface DeepReadonlyArray<T> extends ReadonlyArray<DeepReadonly<T>> {}
+
+type DeepReadonlyObject<T> = {
+  readonly [P in keyof T]: DeepReadonly<T[P]>;
+};

extensions/ql-vscode/src/common/vscode/abstract-webview-view-provider.ts

@@ -3,6 +3,7 @@ import { Uri, WebviewViewProvider } from "vscode";
 import { WebviewKind, WebviewMessage, getHtmlForWebview } from "./webview-html";
 import { Disposable } from "../disposable-object";
 import { App } from "../app";
+import { DeepReadonly } from "../readonly";
 
 export abstract class AbstractWebviewViewProvider<
   ToMessage extends WebviewMessage,
@@ -53,7 +54,7 @@ export abstract class AbstractWebviewViewProvider<
     return this.webviewView?.visible ?? false;
   }
 
-  protected async postMessage(msg: ToMessage): Promise<void> {
+  protected async postMessage(msg: DeepReadonly<ToMessage>): Promise<void> {
     await this.webviewView?.webview.postMessage(msg);
   }
 

extensions/ql-vscode/src/common/vscode/abstract-webview.ts

@@ -12,6 +12,7 @@ import { App } from "../app";
 import { Disposable } from "../disposable-object";
 import { tmpDir } from "../../tmp-dir";
 import { getHtmlForWebview, WebviewMessage, WebviewKind } from "./webview-html";
+import { DeepReadonly } from "../readonly";
 
 export type WebviewPanelConfig = {
   viewId: string;
@@ -146,7 +147,7 @@ export abstract class AbstractWebview<
     this.panelLoadedCallBacks = [];
   }
 
-  protected async postMessage(msg: ToMessage): Promise<boolean> {
+  protected async postMessage(msg: DeepReadonly<ToMessage>): Promise<boolean> {
     const panel = await this.getPanel();
     return panel.webview.postMessage(msg);
   }

extensions/ql-vscode/src/model-editor/auto-model.ts

@@ -19,8 +19,8 @@ import { groupMethods, sortGroupNames, sortMethods } from "./shared/sorting";
  */
 export function getCandidates(
   mode: Mode,
-  methods: Method[],
-  modeledMethodsBySignature: Record<string, ModeledMethod[]>,
+  methods: readonly Method[],
+  modeledMethodsBySignature: Record<string, readonly ModeledMethod[]>,
 ): MethodSignature[] {
   // Sort the same way as the UI so we send the first ones listed in the UI first
   const grouped = groupMethods(methods, mode);
@@ -32,8 +32,9 @@ export function getCandidates(
   const candidates: MethodSignature[] = [];
 
   for (const method of sortedMethods) {
-    const modeledMethods: ModeledMethod[] =
-      modeledMethodsBySignature[method.signature] ?? [];
+    const modeledMethods: ModeledMethod[] = [
+      ...(modeledMethodsBySignature[method.signature] ?? []),
+    ];
 
     // Anything that is modeled is not a candidate
     if (modeledMethods.some((m) => m.type !== "none")) {

extensions/ql-vscode/src/model-editor/auto-modeler.ts

@@ -58,8 +58,8 @@ export class AutoModeler {
    */
   public async startModeling(
     packageName: string,
-    methods: Method[],
-    modeledMethods: Record<string, ModeledMethod[]>,
+    methods: readonly Method[],
+    modeledMethods: Record<string, readonly ModeledMethod[]>,
     mode: Mode,
   ): Promise<void> {
     if (this.jobs.has(packageName)) {
@@ -105,8 +105,8 @@ export class AutoModeler {
 
   private async modelPackage(
     packageName: string,
-    methods: Method[],
-    modeledMethods: Record<string, ModeledMethod[]>,
+    methods: readonly Method[],
+    modeledMethods: Record<string, readonly ModeledMethod[]>,
     mode: Mode,
     cancellationTokenSource: CancellationTokenSource,
   ): Promise<void> {

extensions/ql-vscode/src/model-editor/bqrs.ts

@@ -88,9 +88,16 @@ export function decodeBqrsToMethods(
     }
 
     const method = methodsByApiName.get(signature)!;
-    method.usages.push({
-      ...usage,
-      classification,
+    const usages = [
+      ...method.usages,
+      {
+        ...usage,
+        classification,
+      },
+    ];
+    methodsByApiName.set(signature, {
+      ...method,
+      usages,
     });
   });
 

extensions/ql-vscode/src/model-editor/method.ts

@@ -2,8 +2,8 @@ import { ResolvableLocationValue } from "../common/bqrs-cli-types";
 import { ModeledMethod, ModeledMethodType } from "./modeled-method";
 
 export type Call = {
-  label: string;
-  url: ResolvableLocationValue;
+  readonly label: string;
+  readonly url: Readonly<ResolvableLocationValue>;
 };
 
 export enum CallClassification {
@@ -14,48 +14,48 @@ export enum CallClassification {
 }
 
 export type Usage = Call & {
-  classification: CallClassification;
+  readonly classification: CallClassification;
 };
 
 export interface MethodSignature {
   /**
    * Contains the version of the library if it can be determined by CodeQL, e.g. `4.2.2.2`
    */
-  libraryVersion?: string;
+  readonly libraryVersion?: string;
   /**
    * A unique signature that can be used to identify this external API usage.
    *
    * The signature contains the package name, type name, method name, and method parameters
    * in the form "packageName.typeName#methodName(methodParameters)".
    * e.g. `org.sql2o.Connection#createQuery(String)`
    */
-  signature: string;
+  readonly signature: string;
   /**
    * The package name in Java, or the namespace in C#, e.g. `org.sql2o` or `System.Net.Http.Headers`.
    *
    * If the class is not in a package, the value should be an empty string.
    */
-  packageName: string;
-  typeName: string;
-  methodName: string;
+  readonly packageName: string;
+  readonly typeName: string;
+  readonly methodName: string;
   /**
    * The method parameters, including enclosing parentheses, e.g. `(String, String)`
    */
-  methodParameters: string;
+  readonly methodParameters: string;
 }
 
 export interface Method extends MethodSignature {
   /**
    * Contains the name of the library containing the method declaration, e.g. `sql2o-1.6.0.jar` or `System.Runtime.dll`
    */
-  library: string;
+  readonly library: string;
   /**
    * Is this method already supported by CodeQL standard libraries.
    * If so, there is no need for the user to model it themselves.
    */
-  supported: boolean;
-  supportedType: ModeledMethodType;
-  usages: Usage[];
+  readonly supported: boolean;
+  readonly supportedType: ModeledMethodType;
+  readonly usages: readonly Usage[];
 }
 
 export function getArgumentsList(methodParameters: string): string[] {
@@ -68,7 +68,7 @@ export function getArgumentsList(methodParameters: string): string[] {
 
 export function canMethodBeModeled(
   method: Method,
-  modeledMethods: ModeledMethod[],
+  modeledMethods: readonly ModeledMethod[],
   methodIsUnsaved: boolean,
 ): boolean {
   return (

extensions/ql-vscode/src/model-editor/methods-usage/methods-usage-data-provider.ts

@@ -24,16 +24,17 @@ export class MethodsUsageDataProvider
   extends DisposableObject
   implements TreeDataProvider<MethodsUsageTreeViewItem>
 {
-  private methods: Method[] = [];
+  private methods: readonly Method[] = [];
   // sortedMethods is a separate field so we can check if the methods have changed
   // by reference, which is faster than checking if the methods have changed by value.
-  private sortedMethods: Method[] = [];
+  private sortedMethods: readonly Method[] = [];
   private databaseItem: DatabaseItem | undefined = undefined;
   private sourceLocationPrefix: string | undefined = undefined;
   private hideModeledMethods: boolean = INITIAL_HIDE_MODELED_METHODS_VALUE;
   private mode: Mode = INITIAL_MODE;
-  private modeledMethods: Record<string, ModeledMethod[]> = {};
-  private modifiedMethodSignatures: Set<string> = new Set();
+  private modeledMethods: Readonly<Record<string, readonly ModeledMethod[]>> =
+    {};
+  private modifiedMethodSignatures: ReadonlySet<string> = new Set();
 
   private readonly onDidChangeTreeDataEmitter = this.push(
     new EventEmitter<void>(),
@@ -55,12 +56,12 @@ export class MethodsUsageDataProvider
    * method and instead always pass new objects/arrays.
    */
   public async setState(
-    methods: Method[],
+    methods: readonly Method[],
     databaseItem: DatabaseItem,
     hideModeledMethods: boolean,
     mode: Mode,
-    modeledMethods: Record<string, ModeledMethod[]>,
-    modifiedMethodSignatures: Set<string>,
+    modeledMethods: Readonly<Record<string, readonly ModeledMethod[]>>,
+    modifiedMethodSignatures: ReadonlySet<string>,
   ): Promise<void> {
     if (
       this.methods !== methods ||
@@ -145,10 +146,10 @@ export class MethodsUsageDataProvider
       if (this.hideModeledMethods) {
         return this.sortedMethods.filter((api) => !api.supported);
       } else {
-        return this.sortedMethods;
+        return [...this.sortedMethods];
       }
     } else if (isExternalApiUsage(item)) {
-      return item.usages;
+      return [...item.usages];
     } else {
       return [];
     }
@@ -194,7 +195,7 @@ function usagesAreEqual(u1: Usage, u2: Usage): boolean {
   );
 }
 
-function sortMethodsInGroups(methods: Method[], mode: Mode): Method[] {
+function sortMethodsInGroups(methods: readonly Method[], mode: Mode): Method[] {
   const grouped = groupMethods(methods, mode);
 
   const sortedGroupNames = sortGroupNames(grouped);

extensions/ql-vscode/src/model-editor/methods-usage/methods-usage-panel.ts

@@ -32,12 +32,12 @@ export class MethodsUsagePanel extends DisposableObject {
   }
 
   public async setState(
-    methods: Method[],
+    methods: readonly Method[],
     databaseItem: DatabaseItem,
     hideModeledMethods: boolean,
     mode: Mode,
-    modeledMethods: Record<string, ModeledMethod[]>,
-    modifiedMethodSignatures: Set<string>,
+    modeledMethods: Readonly<Record<string, readonly ModeledMethod[]>>,
+    modifiedMethodSignatures: ReadonlySet<string>,
   ): Promise<void> {
     await this.dataProvider.setState(
       methods,

extensions/ql-vscode/src/model-editor/modeled-method-fs.ts

@@ -14,8 +14,8 @@ import { pathsEqual } from "../common/files";
 export async function saveModeledMethods(
   extensionPack: ExtensionPack,
   language: string,
-  methods: Method[],
-  modeledMethods: Record<string, ModeledMethod[]>,
+  methods: readonly Method[],
+  modeledMethods: Readonly<Record<string, readonly ModeledMethod[]>>,
   mode: Mode,
   cliServer: CodeQLCliServer,
   logger: NotificationLogger,